How to modify my search to data model search by adding a lookup table?

[balu1211]

Hi,

My task involves creating a search in datamodel i.e network_traffic, below is the base search how we could convert it to data model search 

| tstats summariesonly=t
values(All_Traffic.src_ip) as src_ip,
dc(All_Traffic.dest_port) as num_dest_port,
values(All_Traffic.dest_port) as dest_port
from datamodel=Network_Traffic by All_Traffic.dest_ip
| where num_dest_port > 100

 | search NOT [| inputlookup  addresses.csv | search (comments =*scanner*) | fields IP AS ALL_Traffic.src_ip | format ]

colored in red is not working as expected !!

Thanks..

[woodcock]

| tstats ,values(All_Traffic.dest_port) AS dest_port values(All_Traffic.dest_ip) AS dest_ip dc(All_Traffic.dest_ip) AS num_dest_ip dc(All_Traffic.dest_port) AS num_dest_port
FROM datamodel=Network_Traffic
WHERE index="firewall" AND sourcetype="traffic" AND NOT [| inputlookup addresses.csv | search (comments =*scanner*) | table IP | rename IP AS ALL_Traffic.src_ip | format ]
BY All_Traffic.src_ip
| rename All_Traffic.* AS *
| where num_dest_port > 100