How to use a CSV file to search indexes

[sajohnson6]

I have a CSV file already located on our Splunk instance with about 20000 IP's. I would like to use this file to search against our indexed firewall events. I've tried using the join command, it does return some results, but it never finishes. Does anyone know another way to do this?

Thanks in advance.

[skoelpin · Accepted solution]

I've seen this exact same use case before.. Don't use join, you need to use the lookup command and you need to do the lookup after a transformational command like stats for better performance.

Depending on runtime and size, you may also want to consider summarizing your data and having the lookup run against the summarized data to max out performance