You don't say where the traffic analysis comes from ... Any index, source, sourcetype ? Do you want to analyze the activity toward the Splunk Web server itself ? If so, you would start looking in index=_internal source=splunkd_access.log sourcetype=splunkd_ui_access clientip=* Here the clientip is the field that tells you about the incoming connection. If you want to compare it with the lookup you can then add this : ... | LOOKUP <lookup.csv/lookup definition> clientip OUTPUTNEW clientip AS knownIP If the ip address is in the csv, then it will be shown in the knownIP field. If it is unknown, the knownIP field will be inexistent. After what you can filter the results based on the existence of that knownIP field, with: | where isnull(knownIP) or | where isnotnull(knownIP)
... View more