How to implement "not in" in splunk?

[flzhang132]

How to implement "not in" in splunk?
I want to find out the data that is not in the collection, as shown below

But always make mistakes, as shown below.

[vishaltaneja070]

Hello @flzhang132,

Just try this:

index="feeindex" sourcetype=csv dmon=201809
| search NOT [|search index="di_project_map_merger"] | fields project

Just make sure field name in both the index feeindex and "di_project_map_merger" have same field name project

Other wise rename field name in the subsearch

[kristian_kolb]

Assuming that these strings ("App", "APP", "001" etc) are field values of the same field in both indexes - lets call it 'blah' - you could make a subsearch like so;

index=feeindex NOT [search index=di_project_map_merge | dedup blah | table blah] | table blah

But perhaps you are looking for something different?