Hi all, I've trying to establish a lookup table that is used in a query (query below). I've setup the lookup table in Defintions & Files. When I run the query, I get matching events but with 0 results. I have the index, time range and status details. Have removed company specific information. | eval srcip=dstip | lookup lt1 cidr_value AS srcip OUTPUT network AS srcnet, cidr_value AS srccidr | replace internal_private WITH "Internal private" IN srcnet | replace internal_public WITH "Internal public" IN srcnet | replace Unknown WITH "Uknown" IN srcnet | eval srccidr=if(srccidr="Unknown", srcip, srccidr) | stats c(id) AS "# incidents", values(srcnet) AS "netid" by srccidr | eval net=replace(srccidr, "\/+", "") | geoip net | table srccidr netid net_country_name "# incidents" | rename srccidr AS "Network", netid AS "Classification", net_country_name AS "Origin" | sort 15 - "# incidents" | fillnull value="-" If anyone has some ideas on how to produce results. Thanks ... View more