How to use two lookups in a search but exclude values from one of them?

[hyahmadi]

hello splunkers,
I need to exclude in my search, IP values in the second lookup file
| inputlookup file1_lookup.csv | search [|inputlookup file2csv.csv ]
How to resolve that?
Rq:field name= IP Address in the first lookup file
field name= dst in the second lookup file

thanks.

[OL]

Can you try this?

| inputlookup file1_lookup.csv | search [|inputlookup file2csv.csv | fields dst | rename dst AS "IP Address"]

Regards,
Olivier

[hyahmadi]

Hello Olivier thanks for help,
but in my search I have to exclude values for "IP Address" in the second file.
I don't know if I can use the terme NOT to exclude values?