Alerting using inputlookup

[jlayson]

Hi all, im new in splunk, i was wondering if you can help me. This is  the scenario, im using inputlookup. I have csv  file with 2 fields field1 is original ip then field 2 is second ip. What i wanted to do if the user get one of ip address in field 1 and  get any ip address in the field 2 then it will alert. But if the user only get ip address in field 1 and did not get ip address in field2 it will not alert. I have multiple ip address in field 1 and only 4 ip address in field 2. Thank you

[jlayson]

We already have an alert , i just need to add that on the alert as an update.  The user will use there own IP address which is  indicated in field 1 then  the field 2 are 4 address that are not allowed to use if they are using any of the ip address on field1

[ITWhisperer]

Can you share what you currently have?

[ITWhisperer]

Where is "user" coming from (given that your csv only contains ip addresses)?

First you need to build a search query that returns the result you want to alert on. Do you have this already?