I have my main search below. I want to match ip's from my main search to the ip's in my lookup file and output only the events that match. The lookup file field for my ip's is "host_ip" and the field in my main search is "dest_ip". index=fda_sec_suricata sourcetype=suricata (src_ip!=10.X.X.X/X AND src_ip!=172.X.X.X/X AND src_ip!=192.X.X.X/X) (host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X") | eval CVE_listed=if(isnotnull(reference_cve) OR like(signature,"%CVE"),1,0) | rex field=signature "CVE-(?\d+-\d+)" | eval reference_cve="CVE-".reference_cve | search (CVE_listed=1) | dedup reference_cve, src_ip, src_port, dest_ip, dest_port | table category, signature, severity, reference_cve, reference_url, src_ip, src_port, dest_dns, dest_nt_host, dest_ip, dest_port, _time ... View more