i have made the index a data model , but still getting errors that i cant work out  ... View more

i tried breaking it down , but no results   i have made a new lookup with two columns  , one called info is a mix of ip addresses and urls, and the second column just has the word match against all fields i tried the search index=xxxxxxx | inputlookup xxxxx.csv | rename info as query | fields query should that work if anything in the info field is present in the data ? ... View more

i put an ip address i found in my data into the lookup to test the search, but it didnt bring back any results as i dont really understand the search, its hard to see where its not working i guess ... View more

so is this the search i need to run below ? index=myindex ( [ | inputlookup my lookup | rename IPs as query | fields query ] OR [ | inputlookup my lookup | rename URLs as query | fields query ] ) ... View more

Thanks for the reply, im new to splunk, so pardon my silly questions how would i script a search that compares ether column of the lookup against data in the index using what you sent , would that be index=myindex ( [  | inputlookup my lookup | rename IPs as query | fields query ] OR [ | inputlookup my lookup | rename URLs as query | fields query ] ) thanks for your help your_search ([ | inputlookup your_lookup | rename IP AS query | fields query ] OR [ | inputlookup your_lookup | rename URL AS query | fields query ])   ... View more