Only return results with field appearing in a lookup

[pjb2160]

Hello,

I'm looking to only return results for "ad_x" log entries which have an "event_code" listed in the "ad_event_codes.csv" lookup:

sourcetype="ad_x" event_code=[inputlookup ad_event_codes.csv | fields event_code]

I feel I'm close but can't quite get it to work. Any pointers?

Cheers.

[pjb2160]

Many thanks!

[kml_uvce · Accepted solution]

use this...

sourcetype="ad_x" [|inputlookup ad_event_codes.csv | fields event_code]