Hello,  I have a lookup table where a list of MAC addresses are listed with the associated Vendors; basically an identifier. However, the mac address in this lookup table (column name is 'prefix') only has the three characters - xx:xx:xx. What I'm trying to do is write a query to find devices that were assigned/renewed an IP address from the DHCP server and based on their Mac address information in the result, identify the vendor. I was able to filter the first three characters from the result but when adding the lookup table to enrich the result with the Vendor information, I'm getting zero results. What am I doing wrong here? Thanks in advance!  index=some_dhcp description=renew | eval d_mac=dest_mac | rex field=d_mac "(?P<d_mac>([0-9-Fa-f]{2}[:-]){3})" | lookup vendor.csv Prefix as d_mac OUTPUT Prefix Vendor_Name | search Prefix=* | table date dest_mac Vendor_Name description ... View more