Inputlookup Exception List not filtering

[rykermurdock77]

I have a report that shows me all "missing" hosts across our network. I have created a lookup file and definition to filter out any systems we have decommissioned (lookupdefname) and any systems that have been found new on our network within the last 30 days.(lookupdefname2). Even though i've followed step by step how to build this search, it isn't filtering like it should. Any help is appreciated:

| metadata type=hosts index=*
| fields host recentTime
| eval host_fqdn=host
| rex field=host "^(?[^.]+)"
| search NOT
[| inputlookup lookupdefname
| table fieldname ] NOT
[| inputlookup lookupdefname2
| table fieldname]
| dedup host
| where recentTime

[woodcock · Accepted solution]

This has been solved many times including:
Meta Woot!: https://splunkbase.splunk.com/app/2949/
Broken Hosts App for Splunk: https://splunkbase.splunk.com/app/3247/
Alerts for Splunk Admins ("ForwarderLevel" alerts): https://splunkbase.splunk.com/app/3796/
Splunk Security Essentials(https://docs.splunksecurityessentials.com/features/sse_data_availability/): https://splunkbase.splunk.com/app/3435/
Monitoring Console: https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
Deployment Server: https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde...

In any case, try this:

| metadata type=hosts index=*
| fields host recentTime
| eval host_fqdn=host
| rex field=host_fqdn "^(?<host>[^.]+)"
| search NOT
[| inputlookup lookupdefname
| table fieldname 
| rename fieldname AS host
| format ]
AND NOT
[| inputlookup lookupdefname2
| table fieldname
| rename fieldname AS host
| format ]
| dedup host
| where recentTime >= YourThresholdSecondsHere

[rykermurdock77]

Thank you. I had went through and tried quite a few things, but this finally did it.