https://community.splunk.com/t5/Splunk-Search/Compare-Lookup-CSV-with-Search/m-p/243130#M72383 <PRE><CODE>sourcetype=foo NOT [inputlookup hostname.csv | fields+ host] | stats values(host) AS new_hosts </CODE></PRE> <P>The subsearch will exclude all known hosts from the list, so only new hosts are shown in the results</P> Mon, 23 Nov 2015 14:34:42 GMT HeinzWaescher 2015-11-23T14:34:42Z https://community.splunk.com/t5/Splunk-Search/Compare-Lookup-CSV-with-Search/m-p/243129#M72382 <P>Dear Experts ,</P> <P>I have created the Lookup Hostname.csv(Contain only one field Hostname) which contain 100 number of hosts. I need to write a search to compare the hostname.csv with current search(List of unique hostname ) to get the new hostname come to network comparing with hostname.csv.</P> <P>Lets say 101 , a new host came to network . Need to compare with hostname.csv . Display in search output</P> Mon, 23 Nov 2015 14:21:12 GMT https://community.splunk.com/t5/Splunk-Search/Compare-Lookup-CSV-with-Search/m-p/243129#M72382 sumit29 2015-11-23T14:21:12Z https://community.splunk.com/t5/Splunk-Search/Compare-Lookup-CSV-with-Search/m-p/243130#M72383 <PRE><CODE>sourcetype=foo NOT [inputlookup hostname.csv | fields+ host] | stats values(host) AS new_hosts </CODE></PRE> <P>The subsearch will exclude all known hosts from the list, so only new hosts are shown in the results</P> Mon, 23 Nov 2015 14:34:42 GMT https://community.splunk.com/t5/Splunk-Search/Compare-Lookup-CSV-with-Search/m-p/243130#M72383 HeinzWaescher 2015-11-23T14:34:42Z https://community.splunk.com/t5/Splunk-Search/Compare-Lookup-CSV-with-Search/m-p/243131#M72384 <P>hmm, did not work for me until I did:</P> <P>index=blah [inputlookup hostname.csv | table host] | stats values(host) AS "Hosts appearing in Splunk, not on my list"</P> <P>didn't use the "fields+"</P> Wed, 29 Mar 2017 15:11:04 GMT https://community.splunk.com/t5/Splunk-Search/Compare-Lookup-CSV-with-Search/m-p/243131#M72384 Michael 2017-03-29T15:11:04Z