I have two lookup table call lookup1.csv and lookup2.csv both has matching field call fullname.
I want match my lookup1.csv to lookup2.csv and output the value not in the lookup1.csv byt in the lookup2.csv?
| inputlookup lookup1.csv | search NOT [| inputlookup lookup.csv | field fullname]
but this SPL displaying result found in the both look table. Is any way to do this in splunk?
ADDVANCE Thanks
Your query is pretty close. Try the where option to inputlookup and use the format command to put the subsearch results in the right format.
| inputlookup lookup1.csv where NOT [| inputlookup lookup.csv | field fullname | format ]