Hi @katmagee I have a similar scenario. I tried the below approach: - |inputlookup dummyTable.csv where index="abc"
|fields index, host
|search NOT
[search index="abc" |dedup host |table index, host] Please replace: - dummyTable.csv with your lookup table name In my case, index and host are the two common fields between lookup table and index. Please do share if the above approach helps to answer your problem statement.
... View more