Lookup and Correlation Help

[dmenon]

I have lookup that has 2 columns IP address and hostname , I see output when I run command | inputlookup serverip.csv. Now, I want to use these IPs to look at src_ip field in firewall logs and find matches, after match look at destinations like dest_ip,dest_location etc.

| inputlookup serverip.csv and then other query index=firewall | stats values(dest_IP),values(url),values(dest_location) by src_ip , where the src_ip is the IP from the csv.

How do I do the correlation, also the csv as server name which I would like to pull into the output. Thanks in advance for any help.

[Vijeta]

@dmenon Try the below

index=firewall | append[| inputlookup serverip.csv |rename IP as src_ip]| stats values(dest_IP),values(url),values(dest_location) by src_ip