Hi all! Pretty new to splunk so just seeing if this is even possible. I have 2 lookups I have created, one that is users who are in our privileged access AD group (admins) and the other that is machines that are in the same group. What I am trying to do is see who from the USER lookup has logged into which machine in the MACHINE lookup, by using the auth logs that are pumped into splunk. I am trying the search below but I don't seem to be getting anywhere with it   index=auth EventCodeDescription="An account was successfully logged on" [|inputlookup users.csv][| inputlookup machines.csv]   I've also tried with the below but also no luck   index=auth EventCodeDescription="An account was successfully logged on" user=inputlookup users.csv src=inputlookup machines.csv   Any help from the community would be great! ... View more