How to achieve using Eval equals to a field from lookup?

[solaced]

Need some help. I can't wrap my head around this.

Need to lookup a csv which contains clientip, and compare against my results with IP also in field clientip to show in a new column as matching or not matching 

| index=foo  ....

[|inputlookup IPlist.csv | fields clientip | rename clientip AS knownIP]
| eval isMatching = if(clientip == knownIP, "matching", "notmatch")
| table clientip, field x, field y, field z, isMatching

Am I way off base here? Should I be looking at other commands? I get zero results with this. Without it, my main search runs fine and many events with IPs show.

Much appreciated

[solaced]

Thank you for your help.  Makes sense and should've been easy enough looking now at the answer. But spent hours myself. Much appreciated!

[ITWhisperer · Accepted solution]

I am not entirely sure what you are trying to do here

Assuming index foo has a field called clientip and the csv file also has a field called clientip, you can filter your search so that only events from foo with matching ips are kept

index=foo  ... [|inputlookup IPlist.csv | fields clientip]
| table clientip, field x, field y, field z

If you want to keep all events from foo but mark those event with matching client ip, you need to have a field from your csv which is not present in foo, or create one - try something like this

index=foo  ...
| lookup IPlist.csv OUTPUT clientip AS knownIP
| eval isMatching = if(isnotnul(knownIP), "matching", "notmatch")
| table clientip, field x, field y, field z, isMatching