Splunk Search

How do I use the join command to detect if an item is in one list and not another?

ESMaletMa
Explorer

Hi

I need your help for the following:

I have 2 lists: I want to detect when an item is in the list B and NOT in the A

List A: static (from a lookup)
ListB: Dynamic (from a search)

list A:

1

2

3

List B:
1
2
3
4

Result: 4

I do NOT want to detect the oposite when someting is in A and is NOT in B

list A:

1

2

3

4

list B:
1
2
3

Result: None

I tried all the posibilites with "join" command "inner" and "outer" but no luck

thank you very much!

Tags (2)
0 Karma
1 Solution

renjith_nair
Legend

@ESMaletMa,

Assuming the fieldname as FIELD1

"Your dynamic search to get list B with field FIELD1" 
|lookup "list  A lookup file" FIELD1 OUTPUT "other fields from lookup lets say FIELD2" 
|search NOT FIELD2="*"

OR

 "Your dynamic search to get list B with field FIELD1" |fields FIELD1 
 |search NOT [|inputlookup "list  A lookup file"|fields FIELD1]

Run anywhere example

|makeresults |eval country="Australia,NOT_A_COUNTRY"|makemv country delim=","|mvexpand country
|search NOT [inputlookup geo_attr_countries.csv |fields country]
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@ESMaletMa,

Assuming the fieldname as FIELD1

"Your dynamic search to get list B with field FIELD1" 
|lookup "list  A lookup file" FIELD1 OUTPUT "other fields from lookup lets say FIELD2" 
|search NOT FIELD2="*"

OR

 "Your dynamic search to get list B with field FIELD1" |fields FIELD1 
 |search NOT [|inputlookup "list  A lookup file"|fields FIELD1]

Run anywhere example

|makeresults |eval country="Australia,NOT_A_COUNTRY"|makemv country delim=","|mvexpand country
|search NOT [inputlookup geo_attr_countries.csv |fields country]
---
What goes around comes around. If it helps, hit it with Karma 🙂

ESMaletMa
Explorer

can't see that button sorry,I don't have such button, sorry

0 Karma

renjith_nair
Legend

@ESMaletMa, just below the answer - beside Add Comment "Accept"

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

ESMaletMa
Explorer

done! Thanks

0 Karma

ESMaletMa
Explorer

It worked, thank you very much!

0 Karma

renjith_nair
Legend

@ESMaletMa, you are welcome. Please "accept" by clicking on the Accept button to close the thread. thanks!

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...