@imst27  Yes the lookup approach is much better. Its better to simplify giant cidrmatch() block into two clean lookup calls, one for src_ip and one for dest_ip. Eg: | lookup backup_subnets subnet as src_ip OUTPUT comment as src_match | lookup backup_subnets subnet as dest_ip OUTPUT comment as dest_match | where isnull(src_match) AND isnull(dest_match) | table _time src_ip dest_ip src_match dest_match Regards, Prewin If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more