I have a list of malicious URL's that I have inputted into a lookup table called badurls.csv.  I created a field in the table called domains.  I want to compare that lookup table against an Index and specifically against a field called Domain to see if we have any traffic going to this list of malicious URL's.   My .csv file has over 3 million entries.  I tried the search below but its not giving me all results and its complaining about a 10,000 line subsearch limit.   index="dns" | eval d=substr(Domain, 1, len(Domain)-1) | search * [|inputlookup badurls.csv | rename domains as d | fields + d ] | stats count by d Any ideas on a better way to do this? ... View more