Search filter csv emails based off of another csv?

[sulaimancds]

index=mail
| lookup email_domain_whitelist domain AS RecipientDomain output domain as domain_match
| where isnull(domain_match)
| table subject sender values(recipient) values(RecipientDomain) Count values(size)```
| stats values(recipient) values(subject) count by RecipientDomain sender
| sort -count

i have this search running daily. based on the results from the search,  i want to compare the sender field result with another csv file call 123.csv in lookup , there is a field call Email Address in this csv, give me the results if there is a match.

Please help.

Thank you.

[ITWhisperer]

Am I missing something or isn't the answer in the question?

| lookup 123.csv "Email Address" as sender

[sulaimancds]

hi where do i add this line , because it is showing me all the results , not those which match the 123.csv?

[Tom_Lundie]

Add this to the bottom of your search:

| lookup 123.csv "Email Address" as sender
| where isnotnull('Email Address')

 To filter the results for only the Email Addresses in 123.csv