I have a trellis view where I break down my charts into Cities. The labels are something like 'Charlotte, NC'. I can make a drilldown to my details page using the form.city=$trellis.value$. The problem is now I want to improve the performance on my target page. It currently is pulling data for all 100 of my cities then filtering by the city name using a lookup table to convert 'Chartlotte, NC' to 'clt' which I can then apply to a hostname filter. index=data sourcetype=searchdata "string" | eval fields=split(host, "."), market=mvindex(fields, 1) | lookup sitemapping sitecode as market OUTPUT region, sitecity, sitecode | search sitecity="Charlotte, NC" | ... What I would like to do is use tag::host="clt" so that I can filter the records in the initial search. One option is to extract the code somehow from the Trellis, the other is to convert from the label to the code in my query before I do the search part. I tried putting an inputlookup before the search, but that ends up filtering out all the data due to the results of the inputlookup. | inputlookup market-mapping | search sitecity="Charlotte, NC" | fields sitecode | search index=data sourcetype=searchdata "string" tag::host=sitecode The inputlookup by itself returns 'clt' in the example. Running the search by itself returns my data Thanks ... View more