Help with Splunk Enterprise Security IP threat intelligence lookup

[belasker]

Hello Splunkers,

I want to create my own saved search in Splunk Enterprise Security working on IP threat intelligence lookup called:

ip_intel 
search command is : index="apacheSplunkES" | append [ inputlookup email_intel ]|where src_user=email

And the command doesn't return any result even though I'm sure that I have a malicious IP stored in my index.

Thank you

[ssattler]

Load the Optive Threat intel app

then use

index=main dest_ip=*

| lookup local=1 all_dest_ips.csv dest_ip OUTPUT threat_list_name, dest_ip

| search threat_list_name=* | dedup dest_ip | eval dest_ip=mvindex(dest_ip,0)