how to cross

[4nton10]

good day.

I am somewhat new to splunk, I am trying to generate a cross between some malicious IP s I have in a file. csv and I want to compare them with src_ip field and if there are coincidences I throw the result, I understand that you have to generate a lookup but I can not move any further

[yuanliu]

You need to give clearer description.  For example, does the phrase "throw the result" mean to discard event when src_ip is found in file.csv or to only preserve matching events in order to raise an alert?  Have you read command document for lookup?

Here I will give an example assuming that your goal is actually to preserve matching events, and assuming that file.csv contains a single column malicious_ip.

| lookup file.csv src_ip as malicious_ip output malicious_ip as matching
| where isnotnull(matching)