How to compare these two lookups and get the values that are not in the lookup2 (b,c,d)?

Path Finder

Hi Splunkers,

I have two lookups where having a common field "values"

For example:
lookup 1     lookup 2
values           values
a                       a
b                       e
c                       f
d                       g

I need to compare these two lookups and get the values that are not in the lookup2 (b,c,d).

I'm using below query but it's not working. Please help. TIA

|inputlookup lookup1.csv
|stats count by "values"
|search NOT [|inputlookup lookup2.csv |fields "values" | fields - count ]

Labels (2)
0 Karma


That search seems to work, but without knowing what you are getting it's hard to say, but this is another way to do it

|inputlookup lookup1.csv
| eval source="v1"
| append [
  |inputlookup lookup2.csv | fields values
  | eval source="v2"
| stats values(source) as sources by values
| where mvcount(sources)=1 AND sources="v1"

 or you could do it like this

| inputlookup lookup1.csv where NOT [| inputlookup lookup2.csv | fields values ]
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...