You're using an eval command which is overwriting the field EMP_Name_dd with same value of John Public , hence the repetition. If you want to correctly list all the EMP_Name_dd from logs with corresponding details from TechResources2 lookup, try this sourcetype="netcool_prod_app_logs" | lookup TechResources2 EMP_Name as EMP_Name_dd OUTPUT SYS_ID, EMP_Name, EMP_LEVEL_TX, ROLE_EMP_NAME | table EMP_Name_dd SYS_ID,EMP_Name, EMP_LEVEL_TX, ROLE_EMP_NAME If you've a form control (dropdown) using which you want to filter your logs based on some Managing director (I assume it's stored in field EMP_Name_dd , then try like this sourcetype="netcool_prod_app_logs" EMP_Name_dd="$YourDropdownTokenName$"| lookup TechResources2 EMP_Name as EMP_Name_dd OUTPUT SYS_ID, EMP_Name, EMP_LEVEL_TX, ROLE_EMP_NAME | table EMP_Name_dd SYS_ID,EMP_Name, EMP_LEVEL_TX, ROLE_EMP_NAME ... View more