Lookups to compare the difference

D.Demarest — Wed, 09 Oct 2024 20:22:00 GMT

I am trying to find clients missing software, I found all the clients WITH the software, dumped them into a a lookup and now trying to find the difference, basically return the ones NOT in the lookup,
So something like this:

dataset = host_inventory
| filter applications != null
| arrayexpand applications
| alter applicationname=json_extract(applications, "$.application_name")
| alter applicationversion=json_extract(applications, "$.version")
| alter appvendor=json_extract(applications, "$.vendor")
| alter installdate=json_extract(applications, "$.install_date")
| join (dataset = UmbrellaHosts) as UH UH.hostname = host_name
|filter agent_type = "AGENT_TYPE_WORKSTATION"
|filter host_name != hostname

UH.hostname is the hosts from the lookup, and just doing a not equal returns nothing.

In splunk I could do it like this:

index=abc sourcetype=xyz NOT [| inputlookup data.csv | fields ccid]

Appreciate it if someone has any idea how to pull this off?

topic Lookups to compare the difference in Cortex XSIAM Discussions

Lookups to compare the difference