Hi, i am using serveral saved realitime searches for detecting bad requests on the webservers. To exclude some ip addresses, I saved them in a csv file and included it with the command "inputlookup". For example: source="/var/log/httpd/vhost.log" uri_query="*bad_keyword*" NOT [ | inputlookup www_ip_whitelist.csv] | top limit=100 clientip | search count>10 As I understood the csv file is only readed once, when the search is saved. What should I do, if I have an updated list in the csv file? Now I am disableing and reenable the saved searches. ... View more