I have a CSV file already located on our Splunk instance with about 20000 IP's. I would like to use this file to search against our indexed firewall events. I've tried using the join command, it does return some results, but it never finishes. Does anyone know another way to do this?
Thanks in advance.
↧