Using lookup table as source for search

[tmwhitm]

I am looking for a way to perform a search and produce results matching search results against a lookup table or vice versa. The scenario is a lookup table with two columns, IP & Description. I wish to run a search and produce results on the IP addresses that match the IP addresses in the lookup table. My syntax is not correct on what I have been able to test, see below for the SPL I was using. I know there must be a straight forward way to accomplish this task. Much appreciated for any support.

Thank you,
Tom

index="network" sourcetype="cisco:asa" | join src_ip [ search inputlookup append=t FLASHAB000089 | rename IPAddr as src_ip]

[tmwhitm]

The syntax in the accepted answer works great but when I create a lookup table with UrLs, it does not work. Any ideas on how to use a lookup table with UrLs? I have SPL like this that isn't working,

index="p*" [ | inputlookup UrL-Input | stats values(UrL) as url | format ] | stats count by src_ip,url,action
| sort action

The lookup table UrL-Input contains two columns, URL & Description.

Any assistance is appreciated.

Tom

[tmwhitm]

Just tried it and working with a control IP i added to the lookup table. Thank you very much!

[elliotproebstel · Accepted solution]

Here's the syntax I use for such cases:

index="network" sourcetype="cisco:asa" 
[ | inputlookup FLASHAB000089 
  | stats values(IPAddr) as src_ip 
  | format ]