How to search for Dst_ip and Src_ip NOT in lookup table?

[7ryota]

Hi,

I need your help

i have a lookup table as vcs_ip.csv. inside the table, i have a column named as ip. This table is for all the allowed traffic.

How to i construct a query to search for Dst_ip and Src_ip NOT found in the vcs_ip.csv under ip column

[gcusello · Accepted solution]

hi @7ryota,

please try something like this:

<your_search> NOT ( [ | inputlookup vcs_ip.csv | rename ip AS Dst_ip | fields Dst_ip ] OR [ | inputlookup vcs_ip.csv | rename ip AS Src_ip | fields Src_ip ] ) 

Ciao.

Giuseppe