Filter using a lookup.

[aly347774]

I want to write a query whose purpose is to print for users who are not authorized to enter, and of course with the presence of a lookup table, the people who are authorized to enter are present in it.

[ITWhisperer]

Please share some anonymised sample events to show what you are working with

[aly347774]

index="(index name)" sourcetype=source type (host="host1" OR host="host2")
| search NOT [| inputlookup (lookup table name ) | table username] action=success | stats values(username) as user

[ITWhisperer]

OK it looks like it should work - what is your question?

[aly347774]

It does not retrieve the blacklist, but rather it retrieves some of the whitelist. I want to make it pass through the lookuptable and show the user who is not authorized to enter.

[ITWhisperer]

The principle of what you are doing is correct. So, if it is not working, it may come down to the actually data, which understandably you might not want to share. How are the values which are getting through different to the ones which are being removed? How large is your lookup table? Are there any special characters being used?