How to write a query for getting data that is not present in lookup table

[aaa2324]

How to write a query for getting data that is not present in lookup table, compare the input data with lookup table and find only the data is not present in lookup table.

already tried below query not working

index=abc sourcetype=xyz
| lookup data.csv ccid OUTPUT ccid AS found
| where isnull(found)

[aaa2324]

Thanks will try that keep you posted with the results

[gcusello]

Hi @aaa2324,

you have to use a subsearch of the main search containing an inputlookup command, only one attention: fieldnames must be the same both in main search and lookup or remene one of them.

Please try something like this:

index=abc sourcetype=xyz NOT [ | inputlookup data.csv | rename ccid AS found | fields found ]
| ...

Ciao.

Giuseppe