It seems somesoni2 answer you. Although with my knowledge I don't understand the whole answer. But he's right in the lookup part, the lookups are used to add fields and information, not filtering directly, for filtering you have to select the fields you want, as he does: | fields status_lookup (as eh does | table status_lookup, it's the same)
However, I'm not sure why it has to be renamed and also, I'm not quite sure how it works. I have enough knowledge of splunk, I've been using it for 5 months now. I'm sure he has the right answer, so ask him if you need more, I will be following this question to learn more of this.
Sorry not being able to help more 😞
... View more