I'm a  newbie on splunk, trying the basic thing but didn't find any solution. Reaching out if I get the direction/solution. I have the search results with userid using the query. Lookup file(master_users) has all users with column name userid.  I want tonly those userids which are in lookup but not in my search result.  Tried multiple options but didn't find the right solution.  ... View more