Hi Guys, I'm trying to match a result from one search to an Inputlookup. The original search contains "spath" command because the source sends the logs in JSON format. Here is the first search: index="MyIndex" some search filters | spath "EmailAddr" | table "EmailAddr" Here is the second search: [| inputlookup all_identities.csv | fields email ]   The end goal is to take the "EmailAddr" from the first search and match it with the field "email" from the second search so only email addresses that are in the inputlookup will return from the search.  The email address needs to be in both the search and the inputlookup.   I've tried to use the | eval email = spath(_raw,"email") command to place the "email" value in the eval field but that did not do the job.   I would really appreciate the community help on this. Thanks!  ... View more