https://community.splunk.com/t5/Splunk-Search/Splunk-Join-help/m-p/216978#M176007 <P>Doesn't the following search already delivers what you want?</P> <PRE><CODE>search index=bank_nagw_preprod sourcetype=access_log [ | inputlookup IOC.csv | eval INDICATOR_VALUE=replace(INDICATOR_VALUE,"[\[\]]","") |fields INDICATOR_VALUE | rename INDICATOR_VALUE AS clientip ] </CODE></PRE> Fri, 30 Dec 2016 19:44:46 GMT Raschko 2016-12-30T19:44:46Z https://community.splunk.com/t5/Splunk-Search/Splunk-Join-help/m-p/216977#M176006 <P>Hi, We are looking to join INDICATOR VALUE from lookup table to the search and needs to find out if a value is same.</P> <P>Below is sample query I am currently doing:</P> <PRE><CODE> |inputlookup IOC.csv |eval INDICATOR_VALUE=replace(INDICATOR_VALUE,"[\[\]]","") |fields INDICATOR_VALUE |join type=left INDICATOR_VALUE[search index=bank_nagw_preprod sourcetype=access_log clientip=* |dedup clientip |table clientip |rename clientip as INDICATOR_VALUE |fields INDICATOR_VALUE] </CODE></PRE> <P>Thanks</P> Fri, 30 Dec 2016 19:24:40 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Join-help/m-p/216977#M176006 splunker9999 2016-12-30T19:24:40Z https://community.splunk.com/t5/Splunk-Search/Splunk-Join-help/m-p/216978#M176007 <P>Doesn't the following search already delivers what you want?</P> <PRE><CODE>search index=bank_nagw_preprod sourcetype=access_log [ | inputlookup IOC.csv | eval INDICATOR_VALUE=replace(INDICATOR_VALUE,"[\[\]]","") |fields INDICATOR_VALUE | rename INDICATOR_VALUE AS clientip ] </CODE></PRE> Fri, 30 Dec 2016 19:44:46 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Join-help/m-p/216978#M176007 Raschko 2016-12-30T19:44:46Z https://community.splunk.com/t5/Splunk-Search/Splunk-Join-help/m-p/216979#M176008 <P>Without using "join".</P> Fri, 30 Dec 2016 19:45:10 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Join-help/m-p/216979#M176008 Raschko 2016-12-30T19:45:10Z