What my search is trying to do is whenever the search matches an item in the lookup list it should display the results which I can turn into an alert. however, it is not working or displaying results and I cant figure out why
(index=cisco* OR index=proxy)
dest_ip="" OR domain=""
| rename dest_ip as emotet_ip
| rename domain as emotet_domain
[| inputlookup emotet-lookup
| fields emotet_ip , emotet_domain]
| stats values(emotet_ip) as emotetIP, values(emotet_domain) as emotetDomain