I have 2 lookup files as lookup1.csv and lookup2.csv lookup1.csv has the data as below name, designation, server, ipaddress, dept tim, ceo, hostname.com, 1.2.3.5, alldept jim, vp, myhost.com, 1.0.3.5, marketing pim, staff, nohost.com, 4.0.4.8, hr lookup2.csv has the data as below cidr, location 1.2.3.0/24, dc 1.0.3.0/24, carolina 3.4.7.0/24, tx I would like to lookup for the field ipaddress in lookup1.csv with the field cidr in lookup2.csv for the first 3 digits as in x.x.x and get the location field if they match. If the ipaddress doesn't match the first 3 digit of cidr , the location should be marked as "unknown". Expected o/p tim, ceo,1.2.4.5, dc jim, vp, 1.0.3.5, carolina pim, staff, 4.0.4.8, unkown I am looking for the search command in splunk using the 2 lookup tables. Thanks in advance. My search so far has not yield any good results but I am still working on it. ... View more