Lookup file 3000 entries, need to divide into events, so I can isolate user flow of client ip events

[roderick001]

My search is | inputlookup "edgarlog2.csv"

The lookup file has no events attached to it, what is a way to add events from a lookup file whilst viewing it in the main search and reporting app?

Any help would be great, thanks.

[to4kawa]

https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/Inputcsv

please check permission.

https://community.splunk.com/t5/Security/How-to-change-permission/m-p/403043

[roderick001]

Thnaks a lot @to4kawa , I will look into it and get back to you.

[to4kawa]

What is the content of CSV?

[roderick001]

Hi @to4kawa sorry for late reply, the csv file has 15 fields with client ip and date and file references, I can't load it from add data and can only add as lookup, but lookup does not allow me to view it as timestamped events. 

Why can I not load it as add data?

Why can I not view events from lookup?

Thanks  a lot for any help.