I am Running is query where i am using lookup and i want data for only paths which are in lookup file.but when i run this ,the query giving data for those are not even added in lookup file.

[Hemant1]

index=esbsrvprod sourcetype=foldermonitoringError NOT (.log) NOT (.nfs)|eval Instance=case(like(host,"%EU1%"),"EU1", like(host,"%EU3%"),"EU3", like(host,"%EU2P%"),"EU2",like(host,"%AP%"),"AP",like(host,"%AM%"),"AM",like(host,"%CI%"),"CI") | rex field=filePath /(?<folder>.*)/ |  lookup FolderMonitorings.csv Folder as folder, Instance as Instance OUTPUT ThresholdFiles, "Assignment Group" MonType  |  eval folder=replace(folder,"mnt/integration","")  | chart limit=10000 count over Instance by folder

[yannK]

You can use a sub search to call the lookup and return an OR condition , to use as a search condition.

<my search> [ | inputlookup mylookup | table A ] 

will become

<mysearch> A=x OR A=y OR A=z 

for more complex conditions, look at the command format
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Format

[renjith_nair]

@Hemant1,
The initial answer was based on other assumptions and hence removed. Since you need to count the actual events ,
Look for those events which are not matching, ie. for e.g. if there are no matches in the lookup , then probably the MonType will be empty for those events. So adding a condition |search MonType!="" should filter the unmatched events

[Hemant1]

@renjith.nair

yes , i have tried it but didn't work . i want only those paths which are in lookup .can you please suggest some modified query which could help me . please

[renjith_nair]

@Hemant1,
Do you have all the fields, for e.g. MonType has value for unmatched events? If they are null, try
|where NOT isnull(MonType) before the chart command and verify