OK, so it's all about your field names. In your original search you said AccountId=Title, which is looking for a text value of Title in AccountId field, whereas here you are setting BindleName field to the same value as the Title field, which where the confusion comes in. But in your example here you are saying you want to find both the Business field AND the BindleName field from the lookup. Given your description you would probably want something like index=csmp
| rex field=Title "^CSMP\s-\s(?<BindleName>\w+)\s-\s([a-zA-Z0-9 ]*)$"
| lookup CostCentersandAWSAccounts.csv BindleName OUTPUT Business which is saying a) Extract a field called BindleName from the Title field b) Lookup the BindleName field against the same named column in the lookup and OUTPUT the Business field from the lookup Note - when posting searches, use the code block </> to format the SPL for easy reading, as above Hope this helps
... View more