Comments and answers for "Lookup command using a dynamic csv in a real-time search" The latest comments and answers for the question "Lookup command using a dynamic csv in a real-time search" Answer by thisissplunk Looks like as long as you are using the lookup command to match things and not something like inputlookup in a subsearch, the "update=true" argument will work as seen here: Fri, 10 Oct 2014 22:44:00 GMT thisissplunk Comment by jrodman on jrodman's comment Good eyes. That means my answer is wrong. We do have this feature, for realtime searches specifically, when you would tend to want it. At least the documentation clearly states that it does what you want. I have not tried it. Fri, 10 Oct 2014 21:36:11 GMT jrodman Comment by thisissplunk on thisissplunk's answer This is what I feared. What about the "update" argument for lookup command seen here: . Would that do it? If not, what does it do? I need the list to change as soon as the IP addresses for the hosts in question change. So I think this is a legit use of this. If not, can yout hink of some other way to do this with a real-time search? Non real-time searches won't cut it here as we need to ensure we do not miss any events that come in hours late, and need alerts as soon as they hit Splunk. Lastly, how do I do this scripted lookup thing? Fri, 10 Oct 2014 21:24:48 GMT thisissplunk Answer by jrodman A search using a lookup based on a csv file will use only the form that exists at the start of the execution of the search. (If the search was to change the lookup definition mid-search, typically customers would get incoherent output from a search.) You could, if you need to update the lookup dynamically, work around this by using a scripted lookup. Fri, 10 Oct 2014 20:31:56 GMT jrodman