My objective is to make a search that compares the dest_ip field value of outbound traffic with the ip values in a lookup table of malicious IPs that results with any matches. The current search is something simple like: index=NetworkTraffic dest_zone="Internet" NOT src_zone="Internet" to view the outbound traffic. The output includes a dest_ip field.  If I have a lookup table called maliciousIPs.csv, which contains a field called "ip", how do I compare that to the dest_ip field?  Ex: If the dest_ip field value of one of the NetworkTraffic logs is 1.2.3.4 and the IP address 1.2.3.4 exists within maliciousIPs.csv, then the search would result.  ... View more