not equal values in a dataset

[moayadalghamdi]

Hello splunker, i want to write an SPL to list email senders excluding emails in a predefined lookup table.

here's my command:

index=email eventtype="email-events" action=delivered [ | inputlookup group_service_emails_csv.csv| fields Emails | where sender != Emails]

please help me with it, Thanks

[moayadalghamdi · Accepted solution]

i found the answer, just write NOT infrot of the lookup search, like this and modify the  WHERE to RENAME:

index=email eventtype="email-events" action=delivered  NOT [ | inputlookup group_service_emails_csv.csv| fields Emails | rename Emails as sender ]