How to match index search results to CSV lookup

[fdw]

I have a search that returns information about usernames and their IP, machine name, etc.

I want to cross-reference a CSV lookup that has a list of usernames and then the search result would only show the results that match a username in the CSV.

This is what I have been working with so far, but it's not changing my query results.

index=dlp
[|inputlookup users.csv |fields username]
|table username, machine_name, ip_address

My CSV has 1 column labeled username with the fields containing the usernames.

[woodcock]

That should work but may not scale well; try this:

index=dlp
| lookup users.csv username OUTPUT username AS MATCHED
| where isnotnull(MATCHED)
|table username, machine_name, ip_address

[saurabh0912]

Try below query:-
index=dlp
| join username
[|inputlookup users.csv |fields username]
|table username, machine_name, ip_address

I am assuming your outer result must have field with username.