How do I make a Splunk query which would exclude hosts which are in a CSV lookup table?

[kannu]

Hello splunkers ,

I need help with one query. I have all hosts coming in a query when i run index=* and i have some other hosts in a CSV file which i have loaded static using lookups.

I want to run index=* again but I don't want the hosts which are there in CSV to show up in my query.

In short, during search time, i want to exclude all hosts which are there in CSV static file lookup .

I am guessing that join command would work but don't know how can i use .

Please help

[renjith_nair · Accepted solution]

@kannu ,
Try

index="your index"  NOT [|inputlookup yourcsvfile]