https://community.splunk.com/t5/Splunk-Enterprise-Security/Query-using-multiple-lookups/m-p/757962#M12827 <P>I figured it out now ,&nbsp;<BR /><BR /></P><P>`|lookup CrowdStrike_asset_lookup ip AS src_ip OUTPUT nt_host, dns`</P> Wed, 04 Feb 2026 16:51:48 GMT hl 2026-02-04T16:51:48Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Query-using-multiple-lookups/m-p/757950#M12824 <P>Hello,&nbsp;</P><P>&nbsp; &nbsp;Looking for a way to query network traffic and search for IP's that have remote connection software i.e. ms-rdp and compare those ip's to the CrrowdStrike_lookup and print out the nt_host of the user and dns of the user.&nbsp; Everything works expect the CrowdStrike lookup.&nbsp;</P><LI-CODE lang="markup">| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.dest_port) as dest_port latest(All_Traffic.user) as user from datamodel=Network_Traffic where sourcetype="pan:*" All_Traffic.action="allowed" by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.src_port All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.transport All_Traffic.user All_Traffic.signature All_Traffic.vendor_product | `drop_dm_object_name("All_Traffic")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | lookup remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category | lookup CrowdStrike_asset_lookup nt_host AS src OUTPUT dns as ip | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_traffic_filter`</LI-CODE><P>&nbsp;</P> Wed, 04 Feb 2026 13:55:19 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Query-using-multiple-lookups/m-p/757950#M12824 hl 2026-02-04T13:55:19Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Query-using-multiple-lookups/m-p/757954#M12825 <P>What is not working as expected regarding the Crowdstrike lookup?</P><P>Verify the src field exists in the results when the lookup is performed.&nbsp; Also, verify the lookup table has an nt_host field.&nbsp; Confirm both fields use the same format, including case (unless the lookup is defined as case-insensitive).</P> Wed, 04 Feb 2026 15:45:01 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Query-using-multiple-lookups/m-p/757954#M12825 richgalloway 2026-02-04T15:45:01Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Query-using-multiple-lookups/m-p/757962#M12827 <P>I figured it out now ,&nbsp;<BR /><BR /></P><P>`|lookup CrowdStrike_asset_lookup ip AS src_ip OUTPUT nt_host, dns`</P> Wed, 04 Feb 2026 16:51:48 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Query-using-multiple-lookups/m-p/757962#M12827 hl 2026-02-04T16:51:48Z