How to find the delta, what values are missing in lookup table comparing the actual data?

[innoce]

Hi,

I am facing issues to find delta.

I have:

Lookup Table: testpolicies.csv

Field names in Lookup: policyname

index=test sourcetype =test_sourcetype policy=*

Field names :  policy

Now, need to compare Lookup table with  sourcetype using policy field and find all the records/rows which are not exist in Lookup table but in sourcetype. This comparison is based on policy field

Any recommendations will be highly appreciated. Thank you so much.

[innoce]

@ITWhisperer  Hi, This is the expected behaviour

data:
policy 1
policy 11
policy 111
policy 2
policy 22
policy 222

testpolicies.csv
policy 11
policy 22
policy 222

Expected result:
policy 1
policy 111
policy 2

[ITWhisperer]

Your expected result is the opposite of what you said you are trying to do 

---

@innoce wrote:

Now, need to compare Lookup table with  sourcetype using policy field and find all the records/rows which are not exist in Lookup table but in sourcetype. This comparison is based on policy field

---

Please clarify which way round you want it

[ITWhisperer]

index=test sourcetype=test_sourcetype NOT [| inputlookup testpolicies.csv | rename policyname as policy | table policy]