How to compare contents of one lookup to another?

[atebysandwich]

Currently I have an inputlookup csv that contains a list of IP addresses and lookup csv that has a list of subnets. I would like to create a query that shows the IPs in the inputlookup table that are not part of the subnets specified in the lookup. I am stumped on how to do this any instance would be greatly appreciated. 

[richgalloway]

There is no difference between an "inputlookup csv" and a "lookup csv".  They're both CSVs.  Inputlookup and lookup are just two methods for accessing those files.

Create a lookup definition (Settings->Lookups->Lookup definitions) that references the subnets CSV.  In the Advanced settings, put CIDR(subnet) in the Match type box. (Replace "subnet" with the actual name of the subnet field.)

Now you can search for all of the entries in the addresses CSV that don't have a match in the subnets CSV.

| inputlookup addresses.csv
| lookup subnets address AS subnet OUTPUT subnet AS match
| where isnull(match)