The first step is to define lookup 2. Go to Settings->Lookups->Lookup definitions and add a new definition. Map the lookup to the CSV file containing the data. Most importantly, check the Advanced Options box and enter CIDR(IP) in the Match type box.
Once that's done you can create a search.
<<your base search>>
```See if the client IP address is in the exclusion table```
| lookup lookup2 IP as ClientIP OUTPUT description
```If the description field is null then the IP is not in the exclusion table```
| where isnull(description)
```Get the policy name```
| lookup lookup2.csv PolicyID OUTPUT PolicyName
| table ClientIP PolicyName Rules details
---
If this reply helps you, Karma would be appreciated.
