I believe Lookups are available in any search, otherwise you would have to specify in every search to include a lookup. You can view more in the documentation related to lookups. Hope this answer helps clarifying your question. P.S. Also check that your lookup field names are not repeated for another lookup table. That could certainly be an issue as well. http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Addfieldsfromexternaldatasources ... View more