I have a small CSV file with common attack signatures in them that I have uploaded as a lookup called web_attack_signatures.csv: uri_path, description */etc/passwd*, Passwd file access attempt *phpadmin*, PHPadmin access attempt Ignoring the fact that these signatures are inefficient, the idea is that the lookup feeds the search, looking for any attack signature matches matches in my web logs. The relevant field in my logs is also called uri_path. So far I have been able to pull relevant events using this query: earliest=-1d index=web [| inputlookup web_attack_sigs.csv | fields uri_path] But I cannot get get the description field to be added to the results. I've tried adding "description" to the fields command with 0 results, and tried piping the events to another lookup command but that didn't work either. Can anyone help? ... View more