How to filter specfic result

[alexspunkshell]

In my search result, I have the "Description" field.
The Description field contains both texts and 2 IP details.
I want to check both IPs with my lookup table.
If the IPs are not present in the lookup then I need the result.  If the IPs are present in my lookup table then I want to filter the result.

Kindly help here.

alexspunkshell_0-1628093699803.png

[manjunathmeti · Accepted solution]

hi @alexspunkshell, 
Use rex to extract IPs and lookup IPs in the lookup table.

| rex field=Description max_match=0 "(?<IP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" 
| lookup lookup_table lookup_table_IP_field AS IP OUTPUT lookup_table_IP_field as new_field
| where mvcount(IP)=mvcount(new_field)

If this reply helps you, a like would be appreciated.