Yuanliu thank you very much for taking your time to write and help. Below is my response 1. lets forget about outputlookup 2. original main (outer) search of network index is fast by itself given the code that includes bucket, eval and output in stats.  So the delay is not here. 3. dashboard input is account_Name and source_network_address (but i can use tokens to pass network_address) 4. since we are no longer doing lookup table it's a moot point to answer subsequent bullet items.  I'm Sorry. Someone pointed out that its possible to reduce network output by passing parameter to the outer main search using "format" While that code drastically reduces returned set of data from network, query I now need to rethink how to move forward from produced output. I think it a step in a right direction. Let me show what was proposed: Let me explain data structure a bit: snat and client is in a form IP:PORT So we need to match IP:PORT from network and ad indexes as well as time stamp that those events match on. output is just client_ip. i don't need to make any evaluations of count i just want to know how many client_IP we have of each New proposed code is below.  If you look at splunk logging its interesting to see how format appends to network search in form of (snat=ip1 OR snat=ip2 OR ....) index=_network sourcetype=f5 irule=* [| search index=_ad (EventCode=4625 OR (EventCode=4771 Failure_Code=0x18)) Account_Name=USER Source_Network_Address IN (IP1,IP2..) | eval Source_Network_Address1 = case(EventCode==4771, trim(Client_Address, "::ffff:")) | eval SourceIP = Source_Network_Address | eval snat = SourceIP+":"+Source_Port | fields snat | format ] ```passes formated string to main search for _network to find only those snats``` | table client snat _time ```| join type=inner snat _time [ search index=_ad (EventCode=4625 OR (EventCode=4771 Failure_Code=0x18)) Account_Name=USER Source_Network_Address IN (IP1,IP2..) | eval Source_Network_Address1 = case(EventCode==4771, trim(Client_Address, "::ffff:")) | eval SourceIP = Source_Network_Address | eval client = SourceIP+":"+Source_Port | table snat_time] | rex field=client "^(?<client_ip>.*?)\:(?<client_port>.*)" | stats values(client_ip)```

When I do that I have this again   2024-02-09 14:39:40,578 - DEBUG - Arguments reçus: ['/opt/splunk/etc/apps/Ta-Purplelab/bin/mitrepurplelab.py'] 2024-02-09 14:39:40,578 - ERROR - Usage incorrect: python script.py <technique_id>   [mitrepurplelab] chunked = true python.version = python3 filename = mitrepurplelab.py