tl;dr how does renaming a field to "search" help? how to make a map visualization with the lookup table/codes shown? Hello Splunkers, From my previous question, I was doing something related to extracting countries from feeds. However I wasn't able to do the lookup table version answer from my question and I found that using rex doesn't really help me after a while. I chanced upon this question "https://answers.splunk.com/answers/61664/search-set-of-strings-from-lookup-and-list-count-of-occurance.html" and tried the code, and I want to know how does renaming your string field name as search help ? The particular part of the code goes : [| inputlookup your_lookup_here | rename yourStringFieldName as search | fields search | format] I actually just tried this particular code itself and I saw what I wanted to see/extract on the events tab and was wondering how I could make it into a cluster map/choropleth map. The lookup (csv) I have contains fields such as "country", "lat" and "lng" and when I changed the word "search" I couldn't get what I wanted. Also, I tried the code as a whole, I got an error with the rename function on the second line of the code which goes: | rename _raw as rawText Last question, How do I make to make a cluster map using lookup table that contains latitude and longitude as well as country name ? My search on the other hand only have country shown. The below is a statistics of what I have currently gotten Country and count comes from feed whereas lat and lng comes from my country.csv country count lat lng Australia 2 -33.42004148 151.3000048 Bangladesh 1 24.24997845 89.92003048 I also used this code to get the above | lookup simplemaps-worldcities-basic.csv country as country OUTPUTNEW country lng lat Thanks ! ... View more