inputlookup excluding index

[jmo1]

 I am trying to write a query that will ignore events in certain indexes (these indexes change over time).  I have a CSV file with a single column that looks like this...

Index

a

b

c

   NOTE: this is a simple example, it really has 25+ indexes

host=* NOT index=[| inputlookup Index.csv | fields Index]

  This is my non-working attempt.  The actual query is irrelevant (host=*), the point is that I want to ignore any hits where the index is in the CSV file (index!=a index!=b index!=c).

Any help would be greatly appreciated.

[bowesmana · Accepted solution]

You don't need the index=... and case is important, so use this

host=* NOT [ | inputlookup indexes.csv | rename Index as index ]

Note the rename, as your column is Index, not index, so either change the column name in the table and just use | table index or go with the above

[jmo1]

Thank you!  It is working.