https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-an-index-that-do-not-match-with/m-p/225045#M66344 <P>Hi All,</P> <P>I am trying to write a search for extracting fields which are not matching with the lookup file or table. For example, I have the field named <STRONG>category</STRONG> and a lookup table with values similar to category in the index. Now I want to extract fields from the index which are not matching with values in the lookup table. Please help me in writing the search.</P> <P>Thank you in advance</P> Tue, 15 Sep 2015 15:40:36 GMT avis1119 2015-09-15T15:40:36Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-an-index-that-do-not-match-with/m-p/225045#M66344 <P>Hi All,</P> <P>I am trying to write a search for extracting fields which are not matching with the lookup file or table. For example, I have the field named <STRONG>category</STRONG> and a lookup table with values similar to category in the index. Now I want to extract fields from the index which are not matching with values in the lookup table. Please help me in writing the search.</P> <P>Thank you in advance</P> Tue, 15 Sep 2015 15:40:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-an-index-that-do-not-match-with/m-p/225045#M66344 avis1119 2015-09-15T15:40:36Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-an-index-that-do-not-match-with/m-p/225046#M66345 <P>Can you provide name of fields in the index and all fields available in lookup?</P> Tue, 15 Sep 2015 15:59:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-an-index-that-do-not-match-with/m-p/225046#M66345 somesoni2 2015-09-15T15:59:46Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-an-index-that-do-not-match-with/m-p/225047#M66346 <P>Generally, like this:</P> <PRE><CODE>... NOT [|inputlookup MyLookup | fields MyFieldToNotMatch] </CODE></PRE> <P>Just put your base search in place of the ellipsis ( <CODE>...</CODE> ).</P> Tue, 15 Sep 2015 16:14:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-an-index-that-do-not-match-with/m-p/225047#M66346 woodcock 2015-09-15T16:14:29Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-an-index-that-do-not-match-with/m-p/225048#M66347 <P>i have url category, url, username fields in the index and url category in the lookup</P> Wed, 16 Sep 2015 11:53:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-an-index-that-do-not-match-with/m-p/225048#M66347 avis1119 2015-09-16T11:53:45Z