Hi kbrazil899, I was having the same issue as you and finally figured out. It looks like you are running ES version 6 and above. In ES version 6 and above, they retired the saved search for "Identity - Asset String Matches - Lookup Gen" and  "Identity - Asset CIDR Matches - Lookup Gen." You can find more information here: https://docs.splunk.com/Documentation/ES/6.2.0/Admin/Assetandidentitylookups Instead of running saved searches, you run lookups for data to merge. You can get more info here in the how to run lookup searches: https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/ConfigureKVstorelookups For the saved searches above, you can run  | inputlookup asset_lookup_by_str | inputlookup asset_lookup_by_cidr   ... View more