Search for items not matching values from a lookup

[gohar]

Related to http://splunk-base.splunk.com/answers/7581/best-way-to-search-using-a-lookup-table

I want this inverse scenario that what is the best way to search across all of my data and ONLY show items from lookup tables NOT matching with field.

[dwaddle]

This should be easily done with a NOT. Copying gkanapathy's original answer:

sourcetype=web NOT [ inputlookup iptable | fields src_ip | rename src_ip as souce_address ]

[abhayneilam]

Hi,

I have a query like :

index="maa" |rex field="Location" (?(?i)"(abhay)") | eval ONE=lower(ONE) | stats count(ONE) by ONE

my output is coming:

abhay 10

if I give some other keyword which is not matching then it is not diplaying,my output should come as :

abhay 10
murari 0 ( 0 should come along with the keyword name "murari" if no keyword matches..

Please help me to get this one