How to compare these two lookups and get the values that are not in the lookup2 (b,c,d)?

[revanthammineni]

Hi Splunkers,

I have two lookups where having a common field "values"

For example:
lookup 1     lookup 2
values           values
a                       a
b                       e
c                       f
d                       g

I need to compare these two lookups and get the values that are not in the lookup2 (b,c,d).

I'm using below query but it's not working. Please help. TIA

|inputlookup lookup1.csv
|stats count by "values"
|search NOT [|inputlookup lookup2.csv |fields "values" | fields - count ]

[bowesmana]

That search seems to work, but without knowing what you are getting it's hard to say, but this is another way to do it

|inputlookup lookup1.csv
| eval source="v1"
| append [
  |inputlookup lookup2.csv | fields values
  | eval source="v2"
]
| stats values(source) as sources by values
| where mvcount(sources)=1 AND sources="v1"

 or you could do it like this

| inputlookup lookup1.csv where NOT [| inputlookup lookup2.csv | fields values ]