I'm assuming your external file is a Splunk lookup, or that you can make it a Splunk lookup.
And that your [a,b,c,d,e,f] field is called "foo", and say there's at least one other field in that lookup that is present on all rows, that we'll call "bar".
And also let's assume that in the raw data your multivalue field is called mvField.
<your searchterms>
| fields mvField (and whatever few other fields you will ultimately need)
| streamstats count as rowId
| mvexpand mvField
| lookup foo as mvField OUTPUT bar
| where isnull(bar)
| stats values(*) as * by rowId
The idea is to use streamstats to paint a unique id on each row, mvexpand out your multivalue field, wash it through a lookup, then discard the rows that actually matched the lookup. Then finally we use stats values(*) to fold all the expanded rows back up, and end up with mvField being a multivalue field again.
... View more