https://community.splunk.com/t5/Knowledge-Management/Lookup-and-Correlation-Help/m-p/501003#M8412 <P>@dmenon Try the below</P> <PRE><CODE>index=firewall | append[| inputlookup serverip.csv |rename IP as src_ip]| stats values(dest_IP),values(url),values(dest_location) by src_ip </CODE></PRE> Wed, 05 Feb 2020 04:38:58 GMT Vijeta 2020-02-05T04:38:58Z https://community.splunk.com/t5/Knowledge-Management/Lookup-and-Correlation-Help/m-p/501002#M8411 <P>I have lookup that has 2 columns IP address and hostname , I see output when I run command | inputlookup serverip.csv. Now, I want to use these IPs to look at src_ip field in firewall logs and find matches, after match look at destinations like dest_ip,dest_location etc. </P> <P>| inputlookup serverip.csv and then other query index=firewall | stats values(dest_IP),values(url),values(dest_location) by src_ip , where the src_ip is the IP from the csv. </P> <P>How do I do the correlation, also the csv as server name which I would like to pull into the output. Thanks in advance for any help. </P> Wed, 30 Sep 2020 04:00:14 GMT https://community.splunk.com/t5/Knowledge-Management/Lookup-and-Correlation-Help/m-p/501002#M8411 dmenon 2020-09-30T04:00:14Z https://community.splunk.com/t5/Knowledge-Management/Lookup-and-Correlation-Help/m-p/501003#M8412 <P>@dmenon Try the below</P> <PRE><CODE>index=firewall | append[| inputlookup serverip.csv |rename IP as src_ip]| stats values(dest_IP),values(url),values(dest_location) by src_ip </CODE></PRE> Wed, 05 Feb 2020 04:38:58 GMT https://community.splunk.com/t5/Knowledge-Management/Lookup-and-Correlation-Help/m-p/501003#M8412 Vijeta 2020-02-05T04:38:58Z