Hello @lmmills, It is suggested using multiple lookups for different domains / sources etc. as -  There won't be single point of failure - meaning if one lookup file is accidentally deleted, we have other files available Individual lookups can be updated through individual saved searches without touching other lookups If you have multiple domains and which can contain multiple usernames, you can add additional custom field and make it "key" field. So that merging will be in place based on that additional field.   Feel free to accept the answer if that helps! ... View more

You had the right TIME_FORMAT the first time.  These settings should do it.   TIME_PREFIX = start= TIME_FORMAT = %s%3N If you need to experiment with ingest settings, try using the Add Data wizard. ... View more