Search code examples
duplicateslookupsplunk

how to delete common data in two lookups in splunk and gain unique data in the table

i have 2 lookup look1 ip host status type look 2 ip host please help me for how to delete common data in two lookups in splunk and gain unique data in the table thank you

| inputlookup Misili_OA_Daily
  |search NOT  [|inputlookup Misili_OA_Changes
|format]
Solution

  • That query looks close. How is it failing you?

    The key to using a subsearch is to make sure it returns fields present in the main search - otherwise, you'll get no results.

    Assuming Misili_OA_Daily is look1 and Misili_OA_Changes is look2 then this may help.

    | inputlookup Misili_OA_Daily where NOT [|inputlookup Misili_OA_Changes
  | fields ip host | format ]