I am trying to use a lookup we use to track usage of exceptions in one of our platforms so that we can remove unneeded exceptions as needed. In my search, I am bringing my log data in that would represent usage and taking the domain out of the email address to compare against the values in my lookup. the issue I am running into is that my log will show a domain of "test.example.com" but the exception that would be used is "*.example.com". I am looking for an elegant way to add the usage of "test.example.com" to the counter for "*.example.com".  My lookup has headers of OBJECT, CATEGORY, USAGE. OBJECT being where the domain would go. Once I get these counters sorted I would write back to the lookup table with the new value for USAGE.    Including the part of my search I am struggling with: | eval domain=replace(emailAddress,".*?@","") | stats count(domain) as USAGE by domain | eval CATEGORY="domain" | rename domain as OBJECT | table OBJECT,CATEGORY,USAGE | append [| inputlookup exceptions.csv] | stats sum(USAGE) AS USAGE by OBJECT, CATEGORY Any help is appreciated!     ... View more