Thanks all for the comments. I finally got the second lookup to work. I was missing the parameter. Parameters: | rex field=_raw "apicode=>(?<apicode>.*)" | lookup apicode_table apicode output user_id | lookup user_table id as user_id output email ... View more