Query returns zero events

[anikeshp7]

Any suggestions how the query can be improved  

This returns no events as of now.

In the lookup csv Im having UserId and Name as two columns. 

index=123  AND organizationId=00TY00000005677 AND logRecordType=ailtn (Lightning_Console) | dedup sessionKey | lookup test123.csv UserId AS userId OUTPUT UserId AS userId | table userId, sessionKey, _time

[thambisetty]

What would you like to do with lookup command here?

Lookups are used to enrich event information.

you are matching userid from events and lookup and again you are trying get userid from lookup. Were you trying to get name for userId?

have a look at below video.

https://youtu.be/E3-JaZEIXPw

[anikeshp7]

Yes @thambisetty .  Trying to display names with session_key and time

[thambisetty]

index=123 organizationId=00TY00000005677 logRecordType=ailtn (Lightning_Console) 
| stats earliest(_time) as session_start latest(_time) as session_end by sessionKey,userId 
| lookup test123.csv UserId AS userId OUTPUT Name 
| convert ctime(*time) timeformat="%d/%m/%Y %T"