Hello @Splunkers, Can someone please help me on this ? Trying to use "lookup/ inputlookup" command in search. Use case: trying to extract some specific values from logs for given session IDs. But there are more than 200K session IDs to check.  So I created a lookup table which includes 200K sessions and then used below query.   Problem: nothing is returning, but there should be values returned when I checked some session IDs manually. index=testing_car hostname=*prod* "/api/update" | rex field=_raw "CUSTOMER\":(?<FName>[^\,]+)" | rex field=_raw "Session\":\"(?<SID>[^\"]+)" | search [ | lookup Sessions.csv SID | fields SID] | table SID, FName P.S. SID field is available in Session.csv file.  ... View more