I have a search returning all the uuids of firewall policies used in the last 30 days:
sourcetype=fortinet_fortigate_syslog vd=mgt policyid!=0 | table poluuid | dedup poluuid
I have a CSV containing a master list of all policy uuids configured on the firewall.
/opt/splunk/etc/system/lookups/uuids.csv
I would like to construct a search so I can return the values from uuids.csv, less the search results of the uuids from the last 30 days. This is backwards compared to a lookup search I've created in the past. Any ideas?
You can also try using append command to merge results of two queries and then filter the results where count =1 as follows:
sourcetype=fortinet_fortigate_syslog vd=mgt policyid!=0 | dedup poluuid | rename poluuid as uuid | table uuid | append [|inputlookup uuid.csv | table uuid] | stats count by uuid | search count =1 |table uuid.
Have you tried using the ‘set diff’ command?
http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Set