About Krish14

Krish14 · ‎09-29-2023

Excellent, Works fine for me too. Thank you for prompt response! Much appreciated!

Krish14 · ‎09-29-2023

Looks like there is a syntax error "search" keyword I removed it and tried with below, however, the output has all the data from index. We are only interested to output data from index - that is not present in lookup. index=index country_name | table country_name | join type=left country_name [ | inputlookup | stats count as Exist by country_name] | fillnull Exist value=0 | where Exist=0

Krish14 · ‎09-29-2023

Query to output missing data in lookup file. I have a lookup file with below data country_name -------------------- Brazil Norway My index search returns below data for field(country_name) Brazil Norway Spain ------------------------------------------------------------------ How do I write a query (using join or append)- to output only "Spain" in the results. Thanks!

Posts	3
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎09-29-2023

Online Status	Offline
Date Last Visited	‎09-29-2023 04:37 PM

Splunk Lookup compare with index

Re: Splunk Lookup compare with index

Re: Splunk Lookup compare with index

Splunk Lookup compare with index