I'm a Splunk beginner, bear with me.... I am querying a system log file of access events. I have two lookup tables defined: Visitors and Areas. Visitors table has a 6 alphanumeric userid and the Areas table has a 3 digit area number. There are 129 userids in the visitors lookup table and 50+ area_numbers in the areas table Basically I am trying to query an access log on our system to produce a report that tells me if any of the Visitors in the lookup table accessed any of the areas in the areas table, and if so, how many times they accessed any particular area. I have started with: index=events sourcetype=PASSAGES 38D999 [ | inputlookup area.csv | fields area_number ] | stats count by area_number This requires me to run the query with a manually entered visitor ID (38D999). But I can't come up with how to have the query use my Visitor lookup table to get each individual userid and run the query to get the number of accesses each user made in the areas table. Is there a query that can go sequentially through the visitor table, get the first userid, run the query against the areas table and repeat for all 129 visitors? Sample event: 30-Jan-2015 15:16:43, ARGUS_PASSAGE, NORMAL_PASSAGE, "NORMAL_PASSAGE, Station: 268, Unit Name: DOOR G, Portal: 2999, user 003835: Richard David Warrick, Badge: 2675(JO5), From Area 276, To Area 277, Biometrics: Not Configured", user 003835, badge 169739505, station 999, portal 2999, area 277, area 999, AFP 99, building 9999, badge 168234234 Visitor.csv Lab ID,Name,Column1,Column12 000360,Smith,Joe E.,Smith,Joe E. Area.csv area_number 2 5 89 ... View more