How to use Inputlookup

[omrip]

Hi
after importing a csv file i want to compare the hostnames/ipaddresses in the csv file not reporting iis using a specific index

[martin_mueller]

Something like this?

index=foo sourcetype=bar | stats count by ip | eval class = "reporting"
| inputlookup append=t your_file_containing_a_list_of_ips | eval class = coalesce(class, "expected")
| stats values(class) as class by ip
| search class="expected" NOT class="reporting"