How to exclude matching results from Lookup?

[mistydennis]

Hi all - I am trying to exclude matching results from a lookup and can't get it to work. I've tried multiple searches, tried what I've found in Splunk Answers, and I just can't get this to work.

Here's what I have right now:

| inputlookup myinputlookup1 
| search NOT 
    [ |lookup my_lookup InLookField AS LookField OUTPUT InLookField]

This search runs but produces no results. What am I doing wrong? 

[bowesmana · Accepted solution]

If you are using a lookup as a subsearch then you use "inputlookup" rather than lookup. There are three ways to solve your problem, two with subsearches

1. Search after lookup with a subsearch

| inputlookup myinputlookup1 
| search NOT 
    [ | inputlookup my_lookup 
      | fields my_lookup_field_matching_outer_field ]

or

2. Basic Lookup 

| inputlookup myinputlookup1 
| lookup my_lookup InLookField AS LookField OUTPUT InLookField
| where isnull(InLookField)

 or

3. inputlookup with where clause using a subsearch 

| inputlookup myinputlookup1 where NOT
    [ | inputlookup my_lookup 
      | fields my_lookup_field_matching_outer_field ]

 In each subsearch case, you need to make sure that the fields returned by the subsearch are the same as the field you want to filter from the inputlookup