Hi All, I have transaction data from a database and want to compare it with an index in splunk, filtering the transaction data which is has not exist in the index Have query like this : | dbxquery connection=monsplunk query="select userid, acctno, trxamt, trxstatus from "appdb"."apppymt" where accttyp is null " | join type=outer userid [search index=trxpayment_idx | fields userid] | eval mark = if (isnull(userid),"blank",userid) |search mark=blank |table userid, acctno, trxamt, mark when run the query above, the result still shown all data from transaction without filter from index data opposite result with lookup, using a same query and only change index in to inputlookup : | dbxquery connection=monsplunk query="select userid, acctno, trxamt, trxstatus from "appdb"."appymt" where accttyp is null " | join type=outer userid [|inputlookup trxpayment.csv] | eval mark = if (isnull(userid),"blank",userid) |search mark=blank |table userid, acctno, trxamt, mark it shown filtered data from lookup file  I prefer using index compare to lookup file , because the size of data  any one can help with index ? or if you have alternative it would be preferable too ... View more