inputlookup with matching events

[riqbal47010]

I have one lookup file. Now I want to see the list of servers that are in the list but not in AV index.

[jacobpevans]

Greetings @riqbal47010,

Try this (ensuring you have the time option set properly):

| inputlookup lookup.csv
| join type=left max=0 host [
    | index=AV sourcetype=[sourcetype]
    | stats count by host ]
| where isnull(count)

Cheers,
Jacob