How to use a lookup to omit data from results?

[ho000dor]

Hi,
Do i need to do a subsearch for this or is there a more efficient way?

I'm trying to ignore every URL in the "URL" column from the lookup...

index="test1" RESPONSE="50*" URL="*" NOT | lookup 500KNOWN URL

The lookup just has a column with URLs that I want to ignore.

[Raghav2384]

I would use a sub-search.
Example: sourcetype=testapp [|inputlookup userlookup.csv|rename username as user|fields user|where user != "user4"]|stats count by user

[subtrakt]

Thanks I'll give this a shot!

[somesoni2 · Accepted solution]

Use this syntax

   index="test1" RESPONSE="50*" NOT [|inputlookup 500KNOWN | table URL]

[subtrakt]

index="test1" RESPONSE="50*" NOT [|inputlookup 500KNOWN | table URL] | timechart count by URL

[somesoni2]

What is your current query with timechart?

[subtrakt]

Thanks! Will this work with timechart on the main search?