Find user that have latest login

[florencegoh]

I have a listed lookup table xxx .

When I run the below search. it shows no results.

inputlookup xxxx|fields USERNAME|search index=main sourcetype=oracle_aud user=CONN| stats count(user) by source,user

What can be the issue ?

Have check that there is no issue with the lookup table xxx |inputlookup xxxx.

Anyone can provide some good advise?

[florencegoh]

Thank it works for the one

[HiroshiSatoh]

It is how to use sub search.

index=main sourcetype=oracle_aud user=CONN [inputlookup xxxx|fields USERNAME]
⇒index=main sourcetype=oracle_aud user=CONN (USERNAME=AAA OR USERNAME=BBB OR ･･･)

index=main sourcetype=oracle_aud user=CONN [inputlookup xxxx|fields USERNAME |rename USERNAME  as query]
⇒index=main sourcetype=oracle_aud user=CONN (AAA OR BBB OR ･･･)

[hardikJsheth]

What's the purpose of using lookup in the query? Are you fetching metadata from lookup? What's the column through which you are doing join?