Did you ever find an answer to this? I'm having the same issue. I've confirmed that the fields I'm matching on are named identically, and there is overlapping data in those fields from the two sources. In the results however the output fields are all NULL. I even built a test query like such: | inputlookup kvstore_1 | eval index="one" | append [| inputlookup kvstore_2 | eval index="two"] | table item index | stats values(index) by item And I do get "item" values which are associated to both "indexes", indicating the field name and data within the field do match. Example results: item index device_a one two device_b one two Strangely enough if I tack on "|where mvcount(index) >1" similar to what @iomega311 suggests, I get zero results. It's the strangest thing, I cross reference lookup tables all the time, this is the first time I've seen something like this. ... View more

Great trick! Just wanted to note that it appears if you use "Token Value Prefix" and/or "Token Value Suffix" this will not work, it makes is so the input value can never be NULL. So if you had a query like: index=syslog $input$ With: Token Value Prefix = A Token Value Suffix = B You'd end up with: index=syslog AB "Token Prefix", "Token Suffix" and "Delimiter" work fine. ... View more