This query is works for me: sourcetype="dnslogs" answer=* [| inputlookup listofsites.csv | eval query = "\"" . domain_name . "\"" | table query] ... View more