Compare two lookup tables

[brent_weaver]

Hello all... I have to compare two lookup table files in splunk. One is a list of hosts that should Be logging, and the other is a list of what isnt logging. I tried a few different things, to no avail. My goal is to build a list of what isnt logging compared to the list of what is logging.

I mean this is splunk, it cant be that hard 🙂

[sandeepmakkena]

| inputlookup lookupfile1 | lookup lookupfile2 host OUTPUTNEW host as isFound | where isnull(isFound)

Hope this helps, Thanks!