Hi, I am needing to pull multiple fields from a lookup CSV into the results from a proxy search Primary search is: index=PROXY domain=example.com | transaction user maxspan=1m | stats count by user This gives me user - count SURNAME, FIRSTNAME - X(count) Next I have a lookup CSV containing an AD dump that I want to enrich the first search, *note the Nickname field follows the same format as the user field from the proxy results | fields user, Branch, Group, count | lookup AD_all_users.csv Nickname as user, Dep_Branch as Branch, Dep_Group as Group however when I run these searches together we get index=PROXY domain=example.com | transaction user maxspan=1m | stats count by user | fields user, Branch, Group, count | lookup AD_all_users.csv Nickname as user, Dep_Branch as Branch, Dep_Group as Group User - Branch - Group - count SURNAME,FIRSTNAME - NULL - NULL - X(count) anyone able to advise me of wat I have wrong? PS the lookup CSV has about 30 columns and I only need the 3 ... View more