How to match on value NOT in lookup table

[DEADBEEF]

I have a list of IP addresses in a lookup table that are network scanners.

I am trying to build a search that excludes the IP addresses in this lookup table, but for some reason my search keeps including IP address values that are clearly present in the lookup.  I tried putting the quotes around the IP addresses ("1.2.3.4"), tried without quotes (1.2.3.4) but nothing works.  The raw data does not have quotes.  After having tried enough  combinations, I am hoping someone can help me.  Eventually, I'll be adding the remaining IP's to the lookup table via OUTPUTLOOKUP append=true but until I can get this working... I'm stuck.

index=foo sourcetype=bar NOT 
    [| inputlookup network_scanners
    | table IpAddress] 
| dedup IpAddress 
| table IpAddress

[ITWhisperer · Accepted solution]

Have you tried format?

index=foo sourcetype=bar NOT 
    [| inputlookup network_scanners
    | table IpAddress
    | format] 
| dedup IpAddress 
| table IpAddress

[DEADBEEF]

That was the fix!  What about the format command resolved this?

[ITWhisperer]

It formats the events returned by the inputlookup into a string like 

((IpAddress="1.1.1.1") OR (IpAddress="2.2.2.2"))

so it can be used as part of the (initial) search

[DEADBEEF]

Ahh okay.  Is this because the IP address has minor breakers so if you don't use format then it doesn't work as expected?  Just curious as I never had to use it before (but was never matching against IP's).

[ITWhisperer]

Essentially, yes. As I understand it, splunk will sometimes break things up by punctuation so 1.1.1.1 it treated as up to 4 separate strings.