I have one lookup file. Now I want to see the list of servers that are in the list but not in AV index.
Greetings @riqbal47010,
Try this (ensuring you have the time option set properly):
| inputlookup lookup.csv
| join type=left max=0 host [
| index=AV sourcetype=[sourcetype]
| stats count by host ]
| where isnull(count)
Cheers,
Jacob