I have lookup that has 2 columns IP address and hostname , I see output when I run command | inputlookup serverip.csv. Now, I want to use these IPs to look at src_ip field in firewall logs and find matches, after match look at destinations like dest_ip,dest_location etc.
| inputlookup serverip.csv and then other query index=firewall | stats values(dest_IP),values(url),values(dest_location) by src_ip , where the src_ip is the IP from the csv.
How do I do the correlation, also the csv as server name which I would like to pull into the output. Thanks in advance for any help.
