Help with using lookups for combinations of values

[neilsmith2]

I have a simple lookup file with two fields, user and host

user                                host

Bob                                   1

Dave                                  2

Karen                                 x

Sue                                     y


I want exclude any results from my search where there is any combination of host AND user where they match any value from the lookup.

For example, exclude any results where:

the user is Bob and the host is either 1, 2, x or y
the user is either Bob, Dave, Karen or Sue and the host is x 

I'm playing with this search, which appears to work but unsure if there's a flaw in my logic, or if there's a better way to do it?

index=proxy sourcetype="proxy logs"
user="*"

NOT ([| inputlookup lookup.csv  | fields user | format ] AND [| inputlookup lookup.csv  | fields host | format ])

| stats c by username, host

Thanks in advance

[ITWhisperer]

Try something like this

index=proxy sourcetype="proxy logs"
user="*"

NOT [| inputlookup lookup.csv  | eventstats values(host) as host | mvexpand host | format ]

| stats c by username, host