topic Compare query to lookup table but don't print if the results are in the lookup table. in Splunk Search

Compare query to lookup table but don't print if the results are in the lookup table.

hl — Mon, 03 Nov 2025 18:11:14 GMT

index=web host!="*TEST*" | rare limit=10 http_user_agent,c_ip,src,X_Forwarded_For,host ```|lookup static_assets ip as c_ip OUTPUT nt_host``` |table http_user_agent,c_ip,src_X_Forwarded_For,host,nt_host

I have a lookup table with three fields ,
- category
- IP
- nt_host

I would like to compare the results from the search to the lookup table IP and nt_host and only print out the query that isn't in the lookup table.

Re: Compare query to lookup table but don't print if the results are in the lookup table.

richgalloway — Mon, 03 Nov 2025 19:15:03 GMT

You have most of it already. Just on nt_host. If the value is null then it's not in the lookup.

index=web host!="*TEST*" | rare limit=10 http_user_agent,c_ip,src,X_Forwarded_For,host | lookup static_assets ip as c_ip OUTPUT nt_host | where isnull(nt_host) | table http_user_agent,c_ip,src_X_Forwarded_For,host,nt_host

Re: Compare query to lookup table but don't print if the results are in the lookup table.

hl — Mon, 03 Nov 2025 19:43:42 GMT

Ok so within a |where clause the nt_host does have to be actually "null" , null could mean don't use also?

Re: Compare query to lookup table but don't print if the results are in the lookup table.

richgalloway — Mon, 03 Nov 2025 19:51:19 GMT

Null is not the same as "null". The former is the absence of a value while the latter is a specific literal string. The isnull() function tests if the given field has no value.

If a lookup command fails to find a match then the OUTPUT fields will be null (empty).