Hi Can you please let me know how to frame splunk query compare a field from search with a field from lookup and find the unmatched ones from the lookup table
The general form is
<<some search that returns field 'foo'>> NOT [ | inputlookup mylookup.csv | field foo ]
If the lookup file does not contain 'foo' then you'll need a rename command to change what it has to 'foo'.
@richgalloway's solution is one of the possible answers. It has its pros and cons. The other possibility is to search for all events, do a lookup on them and find non-matched ones.
<your_search>
| lookup your_lookup match_field OUTPUT match_field AS new_match_field
| where isnull(new_match_field
Typically you'd use mine option later in the search pipeline while @richgalloway 's solution would probably be more suitable in the initial search.