How to leverage multiple lookup tables in a search

[jrprez1804]

I have two lookup tables:

notablesIp.csv and criticalAsset.csv

notableIP.csv
ip attack
1.1.1.1 Ransomware
1.1.1.2 Malware

CriticalAsset.csv
1.1.1.2
1.1.1.3

Desired results
1.1.1.2 Malware

How would I write a search that would tell me a notable happened on a critical asset?
They share a common field called IP.

[to4kawa]

| inputlookup notablesIP.csv 
| inputlookup append=t  CriticalAsset.csv 
| selfjoin ip

I made a mistake. that's enough.

[13tsavage]

I have never been able to get this search to work even though I see multiple references to just this search @to4kawa. What version of splunk are you using? Because in Splunk Enterprise 8.0.1 this search gets an error.

Error in 'inputlookup' command: This command must be the first command of a search.

Which is why I used the join command by the field ip.

[to4kawa]

I needed a sub search. I wonder if join is good this time.

[13tsavage · Accepted solution]

Try this search:

*| inputlookup notablesIP.csv
| join ip [| inputlookup CriticalAsset.csv ] *

[jrprez1804]

this is perfect also I added the lookup to the kv store so now it is
| inputlookup notableIP | join ip [| inputlookup CriticalAsset]
We are using Splunk ver 7.2