Splunk Search

Why am I getting "Error in 'inputlookup' command: Invalid argument: 'NOT'."?

lbogle
Contributor

Hello Splunkers,

Just checking to see if this is possible or If I'm running into a limitation I didn't know about...
I have a very simple "source of truth" .csv file used as a lookup file. It has a single field with about 70 unique values. I am trying to compare that against a single field with about 60 of the same unique values in an index. I need remove the 60 values in the index from the 70 values in the lookup table so that only the 10 values that are not in the index remain. I had tried by using a simple |inputlookup NOT index field value NOT index field value NOT index field value etc, but I am getting the error:

Error in 'inputlookup' command: Invalid argument: 'NOT'.

I'm guessing you can't NOT a lookup table. Is there some other equivalent command we can use for a lookup table?
Alternately, is there a way for me to accomplish this outside of a simple NOT statement?
Thanks!

0 Karma

sundareshr
Legend

Try this

| inputlookup lookupfile.csv | search NOT [search index=baseindex | stats count by matchingfield | fields - count ]

woodcock
Esteemed Legend

Like this:

<Your Base Search With 70 Values Here> NOT [|inputlookup <YouLookupDefinitionNameHere> | fields <YourFieldNameHere>]
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...