Hi Scelikok, Thank you for the response. Not sure what I might be doing wrong here… but when I try this, it throws an error: Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup ‘my_identity_lookup, identity, AS, user, OUTPUT, priority'. See search.log for more details.. I tied this, which produces results | inputlookup my_identity_lookup | where identity=“xxx.yyy" Then tried this, which does NOT produce results | lookup my_identity_lookup identity AS “xxx.yyy" OUTPUT priority Thoughts on what I'm doing wrong here?
... View more