lookup file csv - Splunk Community

Splunk Search

i have a search in splunk
search dest_ip=10.10.20.3 OR dest_ip=10.2.3.5 OR dest_ip=10.6.7.4 OR dest_ip=10.0.4.6

. I have a file csv
dest_ip
10.10.20.3
10.2.3.5
10.6.7.4
10.0.4.6

how do i change search to lookup file csv

@vumanhtai, try the following:

<yourBaseSearch> [|inputlookup <yourLookupFile>.csv | table dest_ip]

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Get Updates on the Splunk Community!

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...