How do you filter search results based on field-values in a lookup file?

[senthamilselvan]

i have unique 19 address field in a address.csv file,such as
address
/ai/rcmid/abinitio/prod/rcmln/data/mfs/mfs_14way/rcm/rcm_aml_src/main/d_aml_visa_account.dat
/ai/rcmid/abinitio/prod/rcmln/data/mfs/mfs_14way/rcm/rcm_aml_src/main/d_aml_als_account.dat
/ai/rcmid/abinitio/prod/rcmln/data/mfs/mfs_14way/rcm/rcm_aml_src/main/d_aml_impact_account.dat
/ai/rcmid/abinitio/prod/rcmln/data/mfs/mfs_14way/rcm/rcm_aml_src/main/d_aml_fdr_account.dat
/ai/rcmid/abinitio/prod/rcmln/data/mfs/mfs_14way/rcm/rcm_aml_src/main/d_aml_mortgage_account.dat
/ai/rcmid/abinitio/prod/rcmln/data/mfs/mfs_14way/rcm/rcm_aml_src/main/d_aml_compass_account.dat
.......................

and i want to filter my base search results which have only address entries from CSV file

index=dime sourcetype=auditd [search index=dime sourcetype=auditd key=aud_sar success=yes | table msg] | transaction msg
| table node, address, auid, uid
| rename node as "Server", address as "Name"

[DalJeanis · Accepted solution]

Something like this would work, assuming the address.csv file has a field called address that has the URLs you want to match.

index=dime sourcetype=auditd [search index=dime sourcetype=auditd key=aud_sar success=yes | table msg] | transaction msg
| table node, address, auid, uid
| lookup address.csv  address OUTPUT address as foundme
| where address = foundme
| rename node as "Server", address as "Name"