Hi @amsagg Try Something like below, index=stream_dns dest_asset_tag=*dns OR dest_asset_tag=A | rex field=fieldB "(?<fieldB>[^\.]+)"  ## To extract first portion to match with your lookup filed value | table fieldB | eval Flag="1" | append [| inputlookup dnslookup.csv | table fieldA | rename fieldA as fieldB | eval Flag="1"] | eventstats sum(Flag) Flag by fieldB | dedup fieldB | where Flag=1 ##If the field value exists in both index & lookup, the flag will be set to 2. Hence filtering to 1 | table fieldB ... View more