How to write a query for getting data that is not present in lookup table


How to write a query for getting data that is not present in lookup table, compare the input data with lookup table and find only the data is not present in lookup table.

already tried below query not working

index=abc sourcetype=xyz
| lookup data.csv ccid OUTPUT ccid AS found
| where isnull(found)


Labels (1)
0 Karma


Thanks will try that keep you posted with the results

0 Karma


Hi @aaa2324,

you have to use a subsearch of the main search containing an inputlookup command, only one attention: fieldnames must be the same both in main search and lookup or remene one of them.

Please try something like this:

index=abc sourcetype=xyz NOT [ | inputlookup data.csv | rename ccid AS found | fields found ]
| ...



0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...