@rogueakula1  You can try lookup command YOUR_SEARCH | lookup IPAddresses.csv value as addr output Hostname | eval "In IP Addresses"=if(isnotnull(Hostname),"In List","Not In List") | fields - Hostname   My Sample Search : | makeresults | eval _raw="addr 192.168.1.1 192.168.1.2 192.168.1.3 192.168.1.4" | multikv forceheader=1 | table addr | lookup IPAddresses.csv value as addr output Hostname | eval "In IP Addresses"=if(isnotnull(Hostname),"In List","Not In List") | fields - Hostname  Thanks KV ▄︻̷̿┻̿═━一 If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. ... View more

I managed to get the search working. I ended up using a rex field that extracted the IP address from my logs and then used the search NOT. Worked well. Thanks for the response!  index=myindex "string_to_search_for" | rex field=_raw "from (?<IP>[0-9.-]+)" | search NOT      [inputlookup mylookup        | field IP] ... View more