Thank yoo much , got the results as requried. ... View more

Yeah, this is working as expected. ... View more

Hi , Try to use dedup before the 6th step. index=juniper_vpn (ID=AUT22673 OR ID=AUT24803) ......67 | eval src_user=upper(src_user) | join type=left user [| _accounts.csv |search domaine="intra"| eval user=matricule ] | join type=left ua [|_dirigeant.csv | eval ua=UA ] | dedup user | rename user as Matricule, cn as Nom, ua as UA Let me know if that works 🙂 Thanks ... View more