i have a search in splunk
search dest_ip=10.10.20.3 OR dest_ip=10.2.3.5 OR dest_ip=10.6.7.4 OR dest_ip=10.0.4.6
. I have a file csv
dest_ip
10.10.20.3
10.2.3.5
10.6.7.4
10.0.4.6
how do i change search to lookup file csv
@vumanhtai, try the following:
<yourBaseSearch> [|inputlookup <yourLookupFile>.csv | table dest_ip]