I have a whitelist of IP in a lookup table - say LT.csv :: [column name whiteip]
I have a search string say "Search String"
An extracted field called "ipaddress".
I want to generate a report, how many ip from my lookuptable are visible in splunk search result.
Can you help with the query:
"Search String" ["inputlookup LT.csv | fields whiteip] AND "whiteip" = "ipaddress" | stats count by "whiteip"