Great thanks guys.
i had a few errors in my lookup table that caused some weird results.
All good now.
I have used this before as my guide:
search | lookup [lookup definition name] [fieldname1 in lookup table to check] as [fieldname2 in events] OUTPUT [ fieldname3 in lookuptable ] as [fieldname4 - you can create a new name] | search [fieldname4]=”*”
couldn't understand why it wasn't working this time!
... View more