How to search for IP addresses in a lookup that are not found in my events?

[adamsmith47]

I have a lookup which has an IP address column, and I'm trying to find which if the IP addresses from this lookup table DO NOT appear in any of my events.

I've very new to this. I've been trying several things, with no success yet.

Thanks for any replies.

[somesoni2 · Accepted solution]

Try something like this (assuming ip_address is the field that appears in your events and ip_field is the field in lookup table)

index=foo sourcetype=bar [| inputlookup your_ip_lookup.csv | table ip_field | rename ip_field as ip_address] | stats count by ip_address | append [| inputlookup your_ip_lookup.csv | table ip_field | rename ip_field as ip_address | eval count=0 ] | stats max(count) as count by ip_address | where count=0

[adamsmith47]

Perfect. Thank you!