I have a csv lookup table of IP addresses that I want to execute searches on server logs with, but I'm stopped by an error code (title). It tells me the source field (IP) isn't found in the lookup table (IP_lookup), but my lookup definition lists IP as a supported field. I've also tried adding the lookup field through the data model builder (no luck). Search query is index="ef" | lookup IP_lookup IP as clientip OUTPUT IP2 as IP Address For context, my lookup table has two duplicate columns of addresses. Any help would be appreciated.
... View more