How can i set up a watch list ? or a active list ? or list ? or referance set ? like in other SIEMs in SPLUNK

[nuro]

I know that there is a concept of CSV lookup and external lookup and all, but those will create a new field and set a value if the value matches with those in watchlist. What is i need a new field creation and set a value if a partial match with watchlist happens. Can we use regex ?. Also is it possible to edit the file that is already added from the console itself.?

[woodcock]

Have you tried the getwatchlist app?
https://splunkbase.splunk.com/app/635/