https://community.splunk.com/t5/Splunk-Enterprise/multisearch-and-lookup/m-p/565253#M9831 <P>I want to do a multi-search on various systems looking for the src_ip and comparing that src_ip from those systems to a threat intel feed lookup (KV store). When I run the SPL, I get the following error: Multisearch subsearches might only contain purely streaming operations (subsearch 1 contains a non-streaming command). This is the lookup: lookup TF-ip-add indicator as src_ip OUTPUTNEW</P> Mon, 30 Aug 2021 18:37:50 GMT KevinIron1 2021-08-30T18:37:50Z https://community.splunk.com/t5/Splunk-Enterprise/multisearch-and-lookup/m-p/565253#M9831 <P>I want to do a multi-search on various systems looking for the src_ip and comparing that src_ip from those systems to a threat intel feed lookup (KV store). When I run the SPL, I get the following error: Multisearch subsearches might only contain purely streaming operations (subsearch 1 contains a non-streaming command). This is the lookup: lookup TF-ip-add indicator as src_ip OUTPUTNEW</P> Mon, 30 Aug 2021 18:37:50 GMT https://community.splunk.com/t5/Splunk-Enterprise/multisearch-and-lookup/m-p/565253#M9831 KevinIron1 2021-08-30T18:37:50Z https://community.splunk.com/t5/Splunk-Enterprise/multisearch-and-lookup/m-p/565328#M9832 <P>If the search returns a multisearch error then why are you telling us about a lookup?&nbsp; Please share the full query or at least the first subsearch in the multisearch.</P> Tue, 31 Aug 2021 13:21:59 GMT https://community.splunk.com/t5/Splunk-Enterprise/multisearch-and-lookup/m-p/565328#M9832 richgalloway 2021-08-31T13:21:59Z