https://community.splunk.com/t5/Splunk-Search/inputlookup-field-help/m-p/566057#M197240 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/238127">@splfedor</a>&nbsp;</P><P>Did you tried this?</P><LI-CODE lang="markup">index="my_index" [ | inputlookup user_ip.csv | search client_ip="*" | table client_ip ]</LI-CODE><P>KV&nbsp;</P> Tue, 07 Sep 2021 04:35:57 GMT kamlesh_vaghela 2021-09-07T04:35:57Z https://community.splunk.com/t5/Splunk-Search/inputlookup-field-help/m-p/566053#M197239 <P><SPAN>My index has client_ip.</SPAN><BR /><SPAN>However, I want to use the client_ip that exists in the user_ip.csv field.</SPAN><BR /><BR /><SPAN>index="my_index" [ | inputlookup user_ip.csv | search client_ip="*" ]<BR /><BR /></SPAN><BR /><SPAN>Attempted but failed.<BR />After that, I will perform stats.<BR /><BR /></SPAN></P> Tue, 07 Sep 2021 01:42:31 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-field-help/m-p/566053#M197239 splfedor 2021-09-07T01:42:31Z https://community.splunk.com/t5/Splunk-Search/inputlookup-field-help/m-p/566057#M197240 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/238127">@splfedor</a>&nbsp;</P><P>Did you tried this?</P><LI-CODE lang="markup">index="my_index" [ | inputlookup user_ip.csv | search client_ip="*" | table client_ip ]</LI-CODE><P>KV&nbsp;</P> Tue, 07 Sep 2021 04:35:57 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-field-help/m-p/566057#M197240 kamlesh_vaghela 2021-09-07T04:35:57Z