Comparison of field values with a lookup?

[zacksoft_wf]

I have a field in my database datamodel called 'os.user'. And I have a lookup called 'userAccount'.  'userAccount' look up has a field called 'user' that is same as the 'os.user' field of database DM.

I want to know if all of my 'os.user' values are present in the 'userAccount' lookup.  

My requierment is to know if my lookup is sufficient and contains all the user values 'os.user'.

Could use some guisance on the SPL

[gcusello · Accepted solution]

Hi @zacksoft_wf,

you have to run a simple search like this:

| from datamodel:your_datamodel
| search NOT [ inputlookup userAccount | rename user AS os.user | fields os.user ]
| table ...

remember that the output fields of the subsearch must be the same of the main search.

Ciao.

Giuseppe

[gcusello]

Hi @zacksoft_wf,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉