Splunk query to compare a field from search with a field from lookup and find the unmatched ones

[srivardhini92]

Hi Can you please let me know how to frame splunk query compare a field from search with a field from lookup and find the unmatched ones from the lookup table

[richgalloway]

The general form is

<<some search that returns field 'foo'>> NOT [ | inputlookup mylookup.csv | field foo ]

If the lookup file does not contain 'foo' then you'll need a rename command to change what it has to 'foo'.

[PickleRick]

@richgalloway's solution is one of the possible answers. It has its pros and cons. The other possibility is to search for all events, do a lookup on them and find non-matched ones.

<your_search>
| lookup your_lookup match_field OUTPUT match_field AS new_match_field
| where isnull(new_match_field

 Typically you'd use mine option later in the search pipeline while @richgalloway 's solution would probably be more suitable in the initial search.