You seem to be close. You have to add the fields from the lookup you want to be added to the search results. You are also trying to search on "distinguishedName" which is the field from the lookup, not the field that will be in your results from the indexed data. Try: index=wineventlog (EventCode=4720 OR EventCode=4726 OR EventCode=4738 OR EventCode=4724) | lookup adusers distinguishedName AS SubjectUserName OUTPUT title as title | search title="*help desk*" OR title="*Computer Technician*" OR title="*IT specialist*" OR title="*support*" | search SubjectUserName="*OU=Information Technology*" | table SubjectUserName user EventCode _time title Also, since "SubjectUserName" is in the initial indexed data, you can add that to the beginning of the search to filter the initial dataset down even further. I noticed a dedup by user in your original post, so we can also write a stats command which will essentially combine the dedup and the table command to give you clean results. Updated: index=wineventlog (EventCode=4720 OR EventCode=4726 OR EventCode=4738 OR EventCode=4724) SubjectUserName="*OU=Information Technology*" | lookup adusers distinguishedName AS SubjectUserName OUTPUT title as title | search title="*help desk*" OR title="*Computer Technician*" OR title="*IT specialist*" OR title="*support*" | stats values(SubjectUserName) as SubjectUserName, values(EventCode) as event_codes, values(title) as title, earliest(_time) as first_time, latest(_time) as last_time, count by user    ... View more

I'm not sure what you want to do with the data or what the rest of the data/search looks like. You can see these new fields by using the table command (add the below to the end of your search). You can also use other transforming commands if you want to create a visualization with the data. https://docs.splunk.com/Splexicon:Transformingcommand  | table start, end, x1, x2, y1, y2, result   ... View more

The | makeresults were a test. Only add in the regex portion to your search. <Initial Portion of your search> | rex field=start "\"point\"\s\:\s\[(?<x1>\d+\.\d+)\,(?<x2>\d+\.\d+)\]" | rex field=end "\"point\"\s\:\s\[(?<y1>\d+\.\d+)\,(?<y2>\d+\.\d+)\]" | eval result = sqrt( pow((x2 - x1),2) + pow((y2 - y1),2) ) ... View more

You can regex the fields out. | makeresults | eval start="{ \"time_s\" : 1234 , \"point\" : [2.5,5.5]}", end="{ \"time_s\" : 2344 , \"point\" : [9.5,8.5]}" | rex field=start "\"point\"\s\:\s\[(?<x1>\d+\.\d+)\,(?<x2>\d+\.\d+)\]" | rex field=end "\"point\"\s\:\s\[(?<y1>\d+\.\d+)\,(?<y2>\d+\.\d+)\]" | eval result = sqrt( pow((x2 - x1),2) + pow((y2 - y1),2) ) ... View more