Rich, Thank you for the response and apologies for the wrong choice of words. I am fetching data from a SharePoint site, within those data, there are sets of IP addresses that I am searching against. All I want to know is what is currently not stored in the sharepoint site. I dont know if this is clear enough. This is my current search that returns data that matches index="my_sharepoint" sourcetype="deadzone_block"
[| localop
| stats count
| eval entry="block_string"
| eval entry=trim(entry)
| rex field=entry "(?.*?)(\r|\s|$)" max_match=0
| mvexpand search
| table search
| format ]
| table my_table.
Now how can I change this to return only IPs and domains not match in those set of data?
... View more