If you download https://splunkbase.splunk.com/app/7208 Full Tor Node List Lookup App, it comes already with a csv file with IPs in it and post configuring this app, it does not override that lookup and also write to the index mentioned while configuring the input. @efloss    ... View more