Hello Experts, I am new to Splunk and trying to get a search query with subsearch to work. Here is what I have so far: index=palantir_audit host="merlin.palantir.abc.ncc" sourcetype=_json | search "DOS CCD" | search "requestParams.primaryInputs{}.type"=SEARCH_TERMS name=SEARCH | spath output=search_values path=requestParams.primaryInputs{0}.values{0} | spath output=data_sources path=resultParams.additionalContent{}.resources{}.title | table time data_sources search_values The above returns two results at runtime with "DOS CCD" as one or more of values in the data_sources field and i also have a "time" field (doesn't appear to be a reserved word) and a search_values field I want to replace the second line of the main search with a subsearch using the below. The .csv lookup file has three columns of which I am returning "DataSource" |inputlookup Palantir_T3_Collection_Lookup_JSON.csv |rename DataSource as data_sources |table data_sources This runs fine and gets the value "DOS CCD" from the lookup file with no problem, but when I try and pass this result into the main search like this I get no results: index=palantir_audit host="merlin.palantir.abc.ncc" sourcetype=_json [|inputlookup Palantir_T3_Collection_Lookup_JSON.csv |rename DataSource as data_sources |table data_sources] | search "requestParams.primaryInputs{}.type"=SEARCH_TERMS name=SEARCH | spath output=search_values path=requestParams.primaryInputs{0}.values{0} | spath output=data_sources path=resultParams.additionalContent{}.resources{}.title | table time data_sources search_values Any help would be greatly appreciated. Thanks! ... View more