thank you for your time This index, contains information of phone calls. In the first query it works fine, now from the result of this field "Call.OrigParty.CallingPartyAddr" only some numbers also contain the field "Call.CallForwardInfo.LastRedirectingAddr" but only some, I would like to get those numbers from this field and go to compare again to the lookup. The problem I have is that if I call both fields in the same query I get a match on the condition that both fields are present, and I stop seeing the numbers that only meet the first example. ... View more

Hi @gcusello  thankyou for you help    you're right, I am not clear, I will try to explain it much better. I need to perform two queries,  in the first one to get a value from the field "Call.OrigParty.CallingPartyAddr" like this  index="cdr_cfs_index" "Call.TermParty.TrunkGroup.TrunkGroupId"="2230" "Call.OrigParty.CallingPartyAddr"="*" | lookup DIDSMCM Call.OrigParty.CallingPartyAddr OUTPUT Call.OrigParty.CallingPartyAddr AS foundInLookup | where isnull(foundInLookup) | stats count by Call.OrigParty.CallingPartyAddr   In this query it shows me all the numbers that are not in the lookup file and up to this point we are doing well. But I need the result of the first query to now parse a new field "Call.CallForwardInfo.LastRedirectingAddr" I tried the following query: index="cdr_cfs_index" "Call.TermParty.TrunkGroup.TrunkGroupId"="2230" "Call.OrigParty.CallingPartyAddr"="*" "Call.CallForwardInfo.LastRedirectingAddr"="*" | lookup DIDSMCM Call.OrigParty.CallingPartyAddr OUTPUT Call.OrigParty.CallingPartyAddr AS foundInLookup | where isnull(foundInLookup) | stats count by Call.OrigParty.CallingPartyAddr Call.CallForwardInfo.LastRedirectingAddr but it matches everything in the second field omitting the information from the first query.   I would like to know if there is a way to perform the first query and from the result to retrieve another field that is related to the first result and compare it with the lookup.             ... View more

Thanks very much for you help .  I´ll check    ... View more