Thank you for your quick response! I do have a couple of fields in the weblogs that may contain the domain or variations of it. As I am creating the CSV I can name that single column whatever I like so that it matches. There are a couple of "unknowns" here that I believe are making this complicated. In my simple query: index=weblogs somedomain.com | stats count I am searching my results for *somedomain.com* regardless of the field. I certainly can be more specific and designate a single field to search, but I do need to be able to still retain the wildcard aspect so that "somedomain.com" from the list of domains provided by the CSV also finds "somedomain.com", "www.somedomain.com ", "video.somedomain.com", etc. from the weblogs. In my past experience, adding an asterisk such as domain="*somedomain.com" significantly impacted the search and processing. "Significantly" = a search similar to what I'm currently using but with an asterisk was 40% complete after two days, but when I ran the same search without the asterisk completed in a couple of minutes. I am also following up with my Admin to see if there is a means to confirm _which_ field in weblogs is triggering "found" when I execute: index=weblogs somedomain.com | stats count I hadn't thought about it but the initial query's speed may likely be due to the request domain being in an indexed field and it might help my response time if I ensure that I use that field to search as opposed to a non-indexed one. In my attempts to use inputlookup, Splunk refuses to produce a count of hits, 0 found. Though I do not _know_, I _suspect_ that the inputlookup as a subsearch is essentially responding with the entire results/contents, rather than one at a time, iteratively. I spent some time trying to get map or foreach to spit each domain from the CSV to me, one at a time but thus far have been unsuccessful in producing results. Thanks again for your suggestion.
... View more
