i have a search in splunk search dest_ip=10.10.20.3 OR dest_ip=10.2.3.5 OR dest_ip=10.6.7.4 OR dest_ip=10.0.4.6
. I have a file csv dest_ip 10.10.20.3 10.2.3.5 10.6.7.4 10.0.4.6
how do i change search to lookup file csv
@vumanhtai, try the following:
<yourBaseSearch> [|inputlookup <yourLookupFile>.csv | table dest_ip]
