I would recommend changing your csv to have two columns. For example "lookup_ip" and "lookup_reason". The second column could just contain a single value in each row that describes what the list is for (i.e. "my ip blacklist"). Then add the lookup to Splunk. For your search do: index=firewall | lookup ip_list.csv lookup_ip as src_ip In the results, if any event has a src_ip that matches the lookup list you'll see the "lookup_reason" field show up. So you'll have lookup_reason="my ip blacklist". This is a super easy way to pull lookup data in, then you can work it downstream in the search pipeline. ... View more