Exclude results from lookup table in search

[Dalador]

I have a lookup table with Scheduled Tasks called scheduled_tasks, and Columns Command, Arguments. 

I need to do a search where I only display results where the Arguments, Command fields in events DOES NOT contain a value in the scheduled_tasks lookup table. Where it is going wrong? Thank you!
My query is: 

(index IN (index1, index2)) EventCode=4698 NOT [|inputlookup scheduled_tasks |fields Arguments, Command] | fillnull Arguments value="-" | rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |table Command,Arguments |dedup Command,Arguments

My lookup table: 

 

[Dalador]

I need to do a search where I only display results where the Arguments, Command fields in events DOES NOT contain a value in the scheduled_tasks lookup table. Where it is going wrong? Thank you!
My query is: 

(index IN (index1, index2)) EventCode=4698 NOT [|inputlookup scheduled_tasks |fields Arguments, Command] | fillnull Arguments value="-" | rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |table Command,Arguments |dedup Command,Arguments

My lookup table: 

 

[aasabatini]

HI @Dalador 

try like this:

(index IN (index1, index2)) EventCode=4698 [inputlookup scheduled_tasks |fields Arguments, Command | format "(" "(" "AND" ")" "NOT" ")"] | fillnull Arguments value="-" | rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |table Command,Arguments |dedup Command,Arguments

Karma given or solution confirmation appreciated

Alessandro

[Dalador]

Same result 😞 

[aasabatini]

hey @Dalador 

can you show me the results of this search?

|inputlookup scheduled_tasks |fields Arguments, Command | format "(" "(" "AND" ")" "NOT" ")"

if the results is 0 please check if the permission of the lookup is set on  global.

[Dalador · Accepted solution]

I rewrote my query: 
  EventCode=4698 | fillnull Arguments value="-" | rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |search NOT [|inputlookup scheduled_task |fields Arguments, Command]|table Task_Name, ComputerName,Command,_time,Arguments, Account_Name

This works for me 🙂