If you make your csv file a lookup file, everything should just work. Write your csv file (call it mylookup.csv ) to [SplunkHome]/etc/apps/search/lookups . Then in the search bar, if you just type: | inputlookup mylookup you should get the results you want. You should be able to overwrite this file, and the search should still work. ... View more