Compare query to lookup table but don't print if the results are in the lookup table.

[hl]

index=web
host!="*TEST*"
| rare limit=10 http_user_agent,c_ip,src,X_Forwarded_For,host
```|lookup static_assets ip as c_ip OUTPUT nt_host```
|table http_user_agent,c_ip,src_X_Forwarded_For,host,nt_host

I have a lookup table with three fields , 
 - category
- IP
- nt_host

I would like to compare the results from the search to the lookup table IP and nt_host and only print out the query that isn't in the lookup table. 

[hl]

Ok so within a |where clause the nt_host does have to be actually "null" , null could mean don't use also? 

[richgalloway]

Null is not the same as "null".  The former is the absence of a value while the latter is a specific literal string.  The isnull() function tests if the given field has no value.

If a lookup command fails to find a match then the OUTPUT fields will be null (empty).

[richgalloway · Accepted solution]

You have most of it already.  Just on nt_host.  If the value is null then it's not in the lookup.

index=web host!="*TEST*"
| rare limit=10 http_user_agent,c_ip,src,X_Forwarded_For,host
| lookup static_assets ip as c_ip OUTPUT nt_host
| where isnull(nt_host)
| table http_user_agent,c_ip,src_X_Forwarded_For,host,nt_host