I want to do a multi-search on various systems looking for the src_ip and comparing that src_ip from those systems to a threat intel feed lookup (KV store). When I run the SPL, I get the following error: Multisearch subsearches might only contain purely streaming operations (subsearch 1 contains a non-streaming command). This is the lookup: lookup TF-ip-add indicator as src_ip OUTPUTNEW
If the search returns a multisearch error then why are you telling us about a lookup? Please share the full query or at least the first subsearch in the multisearch.
--- If this reply helps you, Karma would be appreciated.
