https://community.splunk.com/t5/Splunk-Search/Search-a-Datamodel-using-field-values-from-a-lookup-csv-file/m-p/540028#M152757 <P>If current DM doesn't bring all src_ip related information from subsearch then you can add all src_ip's using an additional inputlookup and append it to DM results</P><P>| tstats count from datamodel=DM where<BR />[| inputlookup test.csv<BR />| rename src_ip to DM.src_ip<BR />| fields DM.src_ip]<BR />by DM.src_ip<BR />| rename DM.src_ip AS src_ip<BR /><FONT color="#FF0000">| inputlookup test.csv append=t<BR />| stats values(*) as * by src_ip</FONT><BR />| iplocation src_ip<BR />| fillnull value="NULL"<BR />| table src_ip, Country</P> Mon, 15 Feb 2021 23:13:36 GMT PradReddy 2021-02-15T23:13:36Z https://community.splunk.com/t5/Splunk-Search/Search-a-Datamodel-using-field-values-from-a-lookup-csv-file/m-p/540019#M152754 <P>I have a lookup: test.csv that has a list of 10 IP's (src_ip). I want to be able to search a datamodel that&nbsp; looks for traffic from those 10 IPs in the CSV from the lookup and displays info on the IPs even if it doesn't match. Currently I have tried:</P><P>&nbsp;| tstats count from datamodel=DM where<BR />[| inputlookup test.csv | rename src_ip to DM.src_ip<BR />| fields DM.src_ip]<BR />by DM.src_ip&nbsp;</P><P>| rename DM.src_ip AS src_ip</P><P>| iplocation src_ip</P><P>| fillnull value="NULL"</P><P>| table src_ip, Country</P><P>The issue is that if the IP from the lookup isnt found in the DataModel, it doesn't include that entire line, so instead of 10 IPs with 10 countries, I get maybe 5-6 IPs and their respective countries. I want the DM to always include all 10 IPs from the lookup in the table. I understand that I can just use the lookup to get countries, but I specifically want to have the datamodel available for other data while always including all 10 IPs in the table.</P> Mon, 15 Feb 2021 20:59:49 GMT https://community.splunk.com/t5/Splunk-Search/Search-a-Datamodel-using-field-values-from-a-lookup-csv-file/m-p/540019#M152754 mztopp 2021-02-15T20:59:49Z https://community.splunk.com/t5/Splunk-Search/Search-a-Datamodel-using-field-values-from-a-lookup-csv-file/m-p/540028#M152757 <P>If current DM doesn't bring all src_ip related information from subsearch then you can add all src_ip's using an additional inputlookup and append it to DM results</P><P>| tstats count from datamodel=DM where<BR />[| inputlookup test.csv<BR />| rename src_ip to DM.src_ip<BR />| fields DM.src_ip]<BR />by DM.src_ip<BR />| rename DM.src_ip AS src_ip<BR /><FONT color="#FF0000">| inputlookup test.csv append=t<BR />| stats values(*) as * by src_ip</FONT><BR />| iplocation src_ip<BR />| fillnull value="NULL"<BR />| table src_ip, Country</P> Mon, 15 Feb 2021 23:13:36 GMT https://community.splunk.com/t5/Splunk-Search/Search-a-Datamodel-using-field-values-from-a-lookup-csv-file/m-p/540028#M152757 PradReddy 2021-02-15T23:13:36Z