I've got a kvStore lookup, AD_Obj_user, defined with fields objectSid, OU, sAMAccountName, and others.  It has case-insensitive matching. I've got events that contain the field Sid.  I want to lookup the sAMAccountName and automate the lookup, but right now not even the manual lookup works. This works:       | inputlookup AD_Obj_User where objectSid=S-1-2-34-56789012-345678901-234567890-123456 | table objectSid sAMAccountName OU       but this does not work:       index=windows_client source="WinEventLog:PowerShell" Sid=S-1-2-34-56789012-345678901-234567890-123456 | lookup AD_Obj_User objectSid AS Sid | table OU Sid       I can do the lookup successfully, manually, by using this:       index=windows_client source="WinEventLog:PowerShell" Sid=S-1-2-34-56789012-345678901-234567890-123456 | eval objectSid=Sid | join type=left objectSid [| inputlookup AD_Obj_User | table objectSid sAMAccountName OU] | eval User=sAMAccountName | fields - sAMAccountName       but it won't get me towards automating the lookup. Any ideas?  I'm stumped. ... View more