Create a Report of lookup table values minus search results

[ejwade]

I have a search returning all the uuids of firewall policies used in the last 30 days:

sourcetype=fortinet_fortigate_syslog vd=mgt policyid!=0 | table poluuid | dedup poluuid

I have a CSV containing a master list of all policy uuids configured on the firewall.

/opt/splunk/etc/system/lookups/uuids.csv

I would like to construct a search so I can return the values from uuids.csv, less the search results of the uuids from the last 30 days. This is backwards compared to a lookup search I've created in the past. Any ideas?

[hardikJsheth]

You can also try using append command to merge results of two queries and then filter the results where count =1 as follows:

sourcetype=fortinet_fortigate_syslog vd=mgt policyid!=0 | dedup poluuid | rename poluuid as uuid | table uuid | append [|inputlookup uuid.csv | table uuid] | stats count by uuid | search count =1  |table uuid.

[cmerriman]

Have you tried using the ‘set diff’ command?
http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Set