I see, sorry for not making it that clear! The search is to be part of many alerts in my case and not dashboard ... View more

Thanks   The macro is responsible to find matching IPs between the lookup and the search. If the lookup does not exist, then the only thing I need is to not break the search, and that runs as normal. You would wonder, in this case, why I have the lookup inside the search if not existing. The answer is scaling, as that lookup is placed on many searches, and editing them would be time consuming. ... View more

Thanks @vhharanpositka . It works using index searching, but when searching inside the datamodel. This is what I am trying to figure out.   Regards, Vagnet ... View more

Thanks @vhharanpositka . Same results though ... View more

Thanks for the reply @richgalloway . Your input was very helpful! However, I still cannot run the search described as described above: "| inputlookup $lookupFile$ | search $fieldName$ = $searchString$ "   The whole code is found below: <form script="MyScript.js"> <label>Testing</label> <description>For testing of viewing files and their fields</description> <fieldset submitButton="false"></fieldset> <row> <panel> <input type="dropdown" token="lookupFile" searchWhenChanged="true"> <label>lookup</label> <fieldForLabel>lookups</fieldForLabel> <fieldForValue>lookups</fieldForValue> <search> <query>| makeresults | eval lookups="IPFile.csv,MACFile.csv" | makemv delim="," lookups | mvexpand lookups | table lookups</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="fieldName"> <label>Select Field to Search</label> <fieldForLabel>field</fieldForLabel> <fieldForValue>field</fieldForValue> <search> <query>| inputlookup $lookupFile$ | fieldsummary | table field</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <default></default> <prefix>| search "</prefix> <suffix>"</suffix> <choice value="">--</choice> </input> <input type="text" token="searchString" searchWhenChanged="true"> <label>Free string search</label> <default></default> </input> <table> <title>Search in lookup files</title> <search> <query>| inputlookup $lookupFile$ | search FieldName$ = "*$searchString$*"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>   Regards, vagnet ... View more

Hi SirDrake7. I resolved it by increasing the maximum number of concurrent searches on the limits.conf file. ... View more