My index has client_ip.However, I want to use the client_ip that exists in the user_ip.csv field.index="my_index" [ | inputlookup user_ip.csv | search client_ip="*" ]Attempted but failed.After that, I will perform stats.
@splfedor
Did you tried this?
index="my_index" [ | inputlookup user_ip.csv | search client_ip="*" | table client_ip ]
KV