Hi, thats what i tried. But then i get a multi value field "environment" back which contains both prod and test. I could split that into two fields, but in the summary its wrong because than i have 6 prod events insted of 3. Idea behind this is: we have a system that calls for specific functions. Every call is tied to an ID, but since they also test the system it can happen that this id is valid both in prod and test. So when i create a search that queries only for calls from a specific id within the prod environment, i get douple results. Because the id is both found in prod and test. So i wanted to filter for two conditions first one would be the id and second one would be the environment. But that need to happen within the lookup statement and not after wards. Example search with mvexpand: index=XX sourcetype=iis NOT cs_User_Agent=performanceTester cs_uri_stem="*datapoints*values/*" | search XXid=XX475 | lookup local=true lkp_XX_ids_kv XXId AS xx_id OUTPUTNEW SourceSystemName as source_system Environment | mvexpand Environment |search Prod
... View more