https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-the-list-of-hosts-that-are-in-the-lookup-but/m-p/318809#M95341 <P>the set command can help you, i think. your question didn't post the search query, make sure you use the 101 010 code button to format it properly.</P> <PRE><CODE>|set diff [search 1] [|inputlookup hosts_list.csv] </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Set">http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Set</A></P> Thu, 19 Oct 2017 18:55:12 GMT cmerriman 2017-10-19T18:55:12Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-the-list-of-hosts-that-are-in-the-lookup-but/m-p/318807#M95339 <P>I have a query as follows which displays the list of hosts and their host details as follows </P> <PRE><CODE>host field_A field_B field_C </CODE></PRE> <P>Now I have an Excel sheet which I'm trying to use as a lookup "hosts_list.csv"</P> <P>Now I am trying to filter out the list of hosts that are in the lookup but not in my query result. </P> Thu, 19 Oct 2017 18:47:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-the-list-of-hosts-that-are-in-the-lookup-but/m-p/318807#M95339 pavanae 2017-10-19T18:47:51Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-the-list-of-hosts-that-are-in-the-lookup-but/m-p/318808#M95340 <P>Hello, Can you share your search query?</P> Thu, 19 Oct 2017 18:52:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-the-list-of-hosts-that-are-in-the-lookup-but/m-p/318808#M95340 lloydknight 2017-10-19T18:52:37Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-the-list-of-hosts-that-are-in-the-lookup-but/m-p/318809#M95341 <P>the set command can help you, i think. your question didn't post the search query, make sure you use the 101 010 code button to format it properly.</P> <PRE><CODE>|set diff [search 1] [|inputlookup hosts_list.csv] </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Set">http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Set</A></P> Thu, 19 Oct 2017 18:55:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-the-list-of-hosts-that-are-in-the-lookup-but/m-p/318809#M95341 cmerriman 2017-10-19T18:55:12Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-the-list-of-hosts-that-are-in-the-lookup-but/m-p/318810#M95342 <P>and should this not work, just read this answer <A href="https://answers.splunk.com/answers/73268/search-for-hosts-in-a-lookup-but-not-in-splunk.html">https://answers.splunk.com/answers/73268/search-for-hosts-in-a-lookup-but-not-in-splunk.html</A> to get a different approach to make it work <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> <P>cheers, MuS</P> Thu, 19 Oct 2017 19:00:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-the-list-of-hosts-that-are-in-the-lookup-but/m-p/318810#M95342 MuS 2017-10-19T19:00:53Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-the-list-of-hosts-that-are-in-the-lookup-but/m-p/318811#M95343 <P>Hi pavanae,<BR /> try something like this</P> <PRE><CODE>your_search | eval host=upper(host) | stats count by host | append [ | inputlookup host_lookup.csv | eval host=upper(host), count=0 | fields host count ] | stats sum(count) AS Total by host | where Total=0 </CODE></PRE> <P>in this way you have the list of the hosts from your lookup that doesn't match in the main search.<BR /> Bye.<BR /> Giuseppe</P> Fri, 20 Oct 2017 12:19:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-out-the-list-of-hosts-that-are-in-the-lookup-but/m-p/318811#M95343 gcusello 2017-10-20T12:19:48Z