Hello Hello! I'm trying to match the values from a lookup file, in this case being Amazon CIDRS values against ip-adresses that are dynamically retrieved from events, but I can't get it to work, the following is a snippet of what I have.     | append [| inputlookup cidr_aws.csv ] | foreach CIDR [ eval matched_ip = if(cidrmatch(<<FIELD>>, ip_address), ip_address, null()) ] | search matched_ip!=null | table matched_ip, CIDR      There is nothing outputted from this, and if I remove the "| search matched_ip!=null" then I can see that the IP appears which means that it failed the "cidrmatch" comparison and after some experimenting I figured out that the entire thing works If I hardcode either the "<<FIELD>>" value or "ip_address" like the following two examples..     | append [| inputlookup cidr_aws.csv ] | foreach CIDR [ eval matched_ip = if(cidrmatch("3.248.0.0/13", ip_address), ip_address, null()) ] | search matched_ip!=null | table matched_ip, CIDR, Country    or   | append [| inputlookup cidr_aws.csv ] | foreach CIDR [ eval matched_ip = if(cidrmatch(<<FIELD>>, "3.248.163.69"), ip_address, null()) ] | search matched_ip!=null | table matched_ip, CIDR, Country   but this is not optimal since it's supposed to be dynamic.   Does anybody know how to solve this? ... View more