Search for ip in lookup based on system alias in csv

[Trusty]

Helo

I have a search query like this: index=test dscip=192.168.1.1 OR dscip=192.168.1.2 ...

I would like to search this list of ip based on system-alias in my lookup

This is my sample lookup.csv:

system-alias	system-ip
prod	192.168.1.1
dev	192.168.2.2
prod	192.168.1.2

so what a search query should look like if i want to serach only for prod ip`s ?

P

[renjith_nair · Accepted solution]

@Trusty 
You can use the lookup to enrich the dataset and then filter based on the value

|makeresults |eval dscip="192.168.1.1 192.168.2.2 192.168.1.2"|makemv dscip| mvexpand dscip
|rename comment as "Above is just data generation"
|lookup lookup.csv system-ip as dscip OUTPUT system-alias as env
|where env = "prod"

[Trusty]

It works, I have an IP list based on the specified system name (prod etc). Now how can I associate this list with a search?
So that the list of IPs displayed by this query can be attached to dscip
| search sourcetype="new" DstIP=(list of above ip)