https://community.splunk.com/t5/Splunk-Enterprise-Security/how-to-use-ip-intel/m-p/390737#M4216 <P>Can you try something :</P> <PRE><CODE>index=&lt;indexname&gt; .. [|inputlookup ip_intel | return ip] | table src, dest | where src=ip OR dest=ip </CODE></PRE> Tue, 15 May 2018 05:54:22 GMT p_gurav 2018-05-15T05:54:22Z https://community.splunk.com/t5/Splunk-Enterprise-Security/how-to-use-ip-intel/m-p/390736#M4215 <P>I have a search that returns a set of source and dest IP addresses. </P> <PRE><CODE>Index= ..... | table src, dest </CODE></PRE> <P>I want to check these against the ip_intel feed.</P> <P>I can see the ip_intel feed is populated</P> <PRE><CODE>| `ip_intel` | search ip=* </CODE></PRE> <P>How do I use the lookup commands to check against the ip_intel feeds ?</P> Tue, 15 May 2018 04:41:28 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/how-to-use-ip-intel/m-p/390736#M4215 pfgrobler 2018-05-15T04:41:28Z https://community.splunk.com/t5/Splunk-Enterprise-Security/how-to-use-ip-intel/m-p/390737#M4216 <P>Can you try something :</P> <PRE><CODE>index=&lt;indexname&gt; .. [|inputlookup ip_intel | return ip] | table src, dest | where src=ip OR dest=ip </CODE></PRE> Tue, 15 May 2018 05:54:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/how-to-use-ip-intel/m-p/390737#M4216 p_gurav 2018-05-15T05:54:22Z