index=Base456 WiFiMAC="*" earliest=0
| eval LPR = strptime(LastPolicyRequest, "%m/%d/%Y %I:%M:%S %p")
| where LPR >= relative_time(now(),"-7d@h")
| table "WiFiMAC"
| dedup WiFiMAC
| rename COMMENT as "now we use the lookup as a lookup, and compare the results to what we want to drop"
| lookup BASE123.csv u_wifi_mac_address as WiFiMAC OUTPUT discovery_source
| where isnull(discovery_source) OR discovery_source!="AWM"