Splunk Search

How to match my lookup table?

abi2023
Path Finder

my lookup table is history data for the search I am running. from my search and my lookup table I have command field is ID.  I am trying to match the ID from my search to lookup table and display the result from lookup that not match to my search table.  

lookup table name save.csv

my spl 
base search | table _time field1 ID field2

_time field1 ID field2
02/23/23 DEMO1 1054 xyc
02/23/23 Demo2 1426 xyd




below is my lookup table

_time field1 ID
02/23/23 DEMO1 1054

02/10/23

DEMO2 1426
02/05/23 DEMO3

8746

Labels (1)
0 Karma
1 Solution

rut
Path Finder

So you want to display the values that are present in your lookup, but not in your search?

You could flip it by filtering your lookup by your search:

| inputlookup save.csv
| search NOT [ | ..your search.. | fields ID ]

View solution in original post

rut
Path Finder

So you want to display the values that are present in your lookup, but not in your search?

You could flip it by filtering your lookup by your search:

| inputlookup save.csv
| search NOT [ | ..your search.. | fields ID ]
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...