Hi everyone I created a look up table:   Department,Vendor,Type,url_domain,user,src_ip,Whitelisted BigData,Material,Google Remote Desktop,Alpha.com,Alice,172.16.28.12,TRUE   Then I created a look up definition with this match type:   WILDCARD(url_domain), WILDCARD(user), WILDCARD(src_ip)   Then I tested it on following search but it didn't work.   index=fortigate src_ip=172.16.28.12 url_domain=Alpha.com | lookup Whitelist url_domain user src_ip | where isnull(Whitelisted) | table _time, severity, user, url_domain, src_ip, dest_ip, dest_domain, transport, dest_port, vendor_action, app, vendor_eventtype, subtype, devname   and shows all results including traffic from 172.16.28.12 by Alice to the mentioned url  Anyone has any idea what is the issue? ... View more