I have some IP's which I would like to lookup the Country for and match a lookup csv for a specific list of countries.
I have tried various combintation of the following but no joy:
<code>index=* sourcetype=network | iplocation src_ip [inputlookup country_list.csv | fields Country]</c>
Thanks for any suggestions.
This might work if all field names match:
index=* sourcetype=network | iplocation src_ip | search [inputlookup country_list.csv | fields Country]
This might work if all field names match:
index=* sourcetype=network | iplocation src_ip | search [inputlookup country_list.csv | fields Country]
Thank you.