How to show the destination not in the search table?

[Miguel3393]

Hello,

I have a lookup table with numbers, where it checks the numbers that match the error_code 11.

index="cdrs" "error_code"="11" "Destino"="*"

| lookup DIDREPEP Destino OUTPUT Destino | table Destino

But it shows some blank results because they are not in the lookup table.
How can I do so that it only shows me the destination that is not in the search table?.

thanks greetings.

[Miguel3393]

Hello,

The search seems to work, but the destination is still not visible in the table

Regards

[richgalloway]

That's what the isnull function does - it keeps results where the specified field has no value (not visible).  As per the OP: " only shows me the destination that is not in the search table".  If this is not what you expected then please clarify the requirements.

[Miguel3393]

Thanks for the answers. 

How can I visualize in a table the destinations that are not in the lookup?

Regards.

[richgalloway · Accepted solution]

That's different.  To do that, read the lookup in a subsearch and use NOT in the main search to exclude everything already in the lookup.

index="cdrs" "error_code"="11" "Destino"="*" NOT [ | inputlookup DIDREPEP | fields Destino ]

[richgalloway]

Use the isnull function to filter the results.

| lookup DIDREPEP Destino OUTPUT Destino 
| where isnull(Destino)
| table Destino