You can add a flag to your lookup to tell the next part of the pipeline what to do.
e.g.
file.csv:
thing, exclude
some_user,1
other_user,1
Define the lookup as minimum match = 1 and fill unmatched values with 0.
then in your search
event_stream| lookup yourlookup thing | search exclude=0 | do something to what's left
much easier to maintain...
... View more