Hi all,  I wish to generate login times for a list of users which are specified in a lookup table titled user_list.csv. The column header of the list of users in this list is called "IDENTITY". Currently, I have an index that on its own without inserting the lookup table, already has a field called "Identity". This index itself gives me any users' login times within the specified timeframe as long as I specify Identity="*". Without specifying Identity="*" or any other user's names, the events will not populate. What I am trying to do is to input a specified list of users and be able to check their login times. However when I use the following search query, I end up getting 0 events:   index=logintime  [|inputlookup user_list.csv |fields IDENTITY |format] IDENTITY="*" | table _time, eventType, ComputerName, IDENTITY   I have already checked that the lookup table is within the same app. Please help, thank you. ... View more