I am trying to pipe the results of one lookup to another to essentially join the data. In the search below I am trying to use user_id found in apicode and lookup the corresponding email in the user lookup. Parameters: | rex field=_raw "apicode=>(?<apicode>.*)" | lookup apicode_table apicode output user_id | lookup user_table user_id output email I get the following error. Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table I assume this is because user_id is not available from the db yet. How can I lookup from a second table based on the first table? ... View more