https://community.splunk.com/t5/Splunk-Dev/How-to-use-Inputlookup/m-p/320742#M4478 <P>Something like this?</P> <PRE><CODE>index=foo sourcetype=bar | stats count by ip | eval class = "reporting" | inputlookup append=t your_file_containing_a_list_of_ips | eval class = coalesce(class, "expected") | stats values(class) as class by ip | search class="expected" NOT class="reporting" </CODE></PRE> Tue, 21 Feb 2017 13:07:50 GMT martin_mueller 2017-02-21T13:07:50Z https://community.splunk.com/t5/Splunk-Dev/How-to-use-Inputlookup/m-p/320741#M4477 <P>Hi<BR /> after importing a csv file i want to compare the hostnames/ipaddresses in the csv file not reporting iis using a specific index</P> Tue, 21 Feb 2017 12:06:55 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-use-Inputlookup/m-p/320741#M4477 omrip 2017-02-21T12:06:55Z https://community.splunk.com/t5/Splunk-Dev/How-to-use-Inputlookup/m-p/320742#M4478 <P>Something like this?</P> <PRE><CODE>index=foo sourcetype=bar | stats count by ip | eval class = "reporting" | inputlookup append=t your_file_containing_a_list_of_ips | eval class = coalesce(class, "expected") | stats values(class) as class by ip | search class="expected" NOT class="reporting" </CODE></PRE> Tue, 21 Feb 2017 13:07:50 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-use-Inputlookup/m-p/320742#M4478 martin_mueller 2017-02-21T13:07:50Z