Hi @Obsidian_RS400 , let me understand: you have a lookup with a list of ips but without hostname and you want to complete the lookup taking the hostnames from the events, is this correct? If this is your requirement, you could run something like this: assuming the in the lookup you have two fields IP and hostname and that in the events you have the same fields: index=your_index | dedup hostname IP | fields IP hostname | append [ | inputlookup ipaddress.csv | fields IP hostname ] | stats values(hostname) AS hostname BY IP | outputlookup ipaddress.csv Ciao. Giuseppe ... View more