That did not work for me, but I ended up figuring it out using the following: | inputlookup lookup1.csv | rex field=User "^(?<UserShort>.+?)\-suffix" | eval identity = if(isnull(UserShort), User, UserShort) | join identity [inputlookup lookup2] ... ... View more