A number of issues with your search. You use fields command, which effectively removes load_date from your fields and you try to use that after the fields statement Using join+inputlookup is not a good way to use lookup - the lookup command is for that You can't do numeric calculations on string formatted dates, as in your where statement I suspect something like this will do your trick index="myindex" sourcetype="mysource" | fields identifier_1 identifier_2 load_date | eval fail_date=strftime(relative_time(load_date, "+d"), "%m/%d/%Y") | lookup mylookup.csv ID_1 as identifier_1 EVENT_TS as fail_date create the fail_date string based on the day after load_date and then lookup the ID_1 and EVENT_TS based on the data you have   ... View more