Dear all I have 2 data sources: logs forwared to the server as : sourcetype=eea:loghandler and lookup definition file as users_with_email file called users_with_email.csv I have a key field in both sources the same: in sourcetype=eea:loghandler is called user with values like firstname.lastname@domain.com and in lookup definition file I have email field, same value firstname.lastname@domain.com and this is the case for all users I need to get an aggregated reports of users from sourcetype=eea:loghandler by joining the department field from lookup definition file users_with_email(users_with_email.csv) When I try to make an OR: sourcetype=eea:loghandler OR inputlookup users_with_email got no results ... View more