my lookup table is history data for the search I am running. from my search and my lookup table I have command field is ID. I am trying to match the ID from my search to lookup table and display the result from lookup that not match to my search table.
lookup table name save.csv
my spl
base search | table _time field1 ID field2
_time | field1 | ID | field2 |
02/23/23 | DEMO1 | 1054 | xyc |
02/23/23 | Demo2 | 1426 | xyd |
below is my lookup table
_time | field1 | ID |
02/23/23 | DEMO1 | 1054 |
02/10/23 |
DEMO2 | 1426 |
02/05/23 | DEMO3 |
8746 |
So you want to display the values that are present in your lookup, but not in your search?
You could flip it by filtering your lookup by your search:
| inputlookup save.csv
| search NOT [ | ..your search.. | fields ID ]
So you want to display the values that are present in your lookup, but not in your search?
You could flip it by filtering your lookup by your search:
| inputlookup save.csv
| search NOT [ | ..your search.. | fields ID ]