Splunk Search

How to match my lookup table?

abi2023
Path Finder

my lookup table is history data for the search I am running. from my search and my lookup table I have command field is ID.  I am trying to match the ID from my search to lookup table and display the result from lookup that not match to my search table.  

lookup table name save.csv

my spl 
base search | table _time field1 ID field2

_time field1 ID field2
02/23/23 DEMO1 1054 xyc
02/23/23 Demo2 1426 xyd




below is my lookup table

_time field1 ID
02/23/23 DEMO1 1054

02/10/23

DEMO2 1426
02/05/23 DEMO3

8746

Labels (1)
0 Karma
1 Solution

rut
Path Finder

So you want to display the values that are present in your lookup, but not in your search?

You could flip it by filtering your lookup by your search:

| inputlookup save.csv
| search NOT [ | ..your search.. | fields ID ]

View solution in original post

rut
Path Finder

So you want to display the values that are present in your lookup, but not in your search?

You could flip it by filtering your lookup by your search:

| inputlookup save.csv
| search NOT [ | ..your search.. | fields ID ]
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...