@somesoni2 That's awesome. I wasn't successful in excluding events with the stats command. I changed to the table command and verified the search works. Thanks! index=index1 NOT [search index=summary | table primaryKeyField ] | addinfo | collect index=summary ... View more

lookup does not, but you may be able to achieve what you're looking for by using a KV Store instead. See this link for configuring a KV Store from a CSV file: http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/ConfigureKVstorelookups And see this link for examples of using a where clause with the KV Store (in the "Filters and queries" section): http://dev.splunk.com/view/SP-CAAAEZH ... View more