You have 2 problems; first you are swapping the lookup name and event name positions and you have extra spaces in your LOOKUP- name (or perhaps it was supposed to be a second input field and you forgot to use AS and put it in the wrong place?). I have made a guess how to fix everything below: [splunk_web_access] LOOKUP-AD = AD_User_List user AS cn OUTPUTNEW UserFullName AS FullName [source::/opt/splunk/var/log/splunk/web_access.log] LOOKUP-Lookup-AD_Source_Attempt = AD_User_List user AS cn OUTPUTNEW UserFullName AS FullName ... View more

Not exactly. When I append the second dataset, it does exactly that. But before I let Splunk append it, I need to normalize the field TeamDels to match the field in the first dataset. That way I can do a breakout across the combined dataset by a field that exists in both sets. ... View more