diff --git a/README.md b/README.md
index c0903fb..c009ee0 100644
--- a/README.md
+++ b/README.md
@@ -163,13 +163,13 @@ Source: https://opendbl.net/
 BY Web.user, Web.src, Web.dest, Web.site, Web.url, Web.category, Web.action, index, _time span=1s
 | rename Web.* AS *
 | lookup urlhaus-filter-splunk-online host AS site, host AS dest OUTPUT message AS description, updated
-| lookup urlhaus-filter-splunk-online path_wildcard_prefix AS vendor_url, host AS site, host AS dest OUTPUT message AS description2, updated AS updated2
-| lookup phishing-filter-splunk host AS site, host AS dest OUTPUT message AS description3, updated AS updated3
-| lookup phishing-filter-splunk path_wildcard_prefix AS vendor_url, host AS site, host AS dest OUTPUT message AS description4, updated AS updated4
-| lookup pup-filter-splunk host AS site, host AS dest OUTPUT message AS description5, updated AS updated5
-| lookup vn-badsite-filter-splunk host AS site, host AS dest OUTPUT message AS description6, updated AS updated6
-| lookup botnet_ip dst_ip AS dest OUTPUT malware AS description7, updated AS updated7
-| eval Description=coalesce(description, description2, description3, description4, description5, description6, description7)
+| lookup urlhaus-filter-splunk-online path_wildcard_prefix AS vendor_url, host AS site, host AS dest OUTPUTNEW message AS description, updated
+| lookup phishing-filter-splunk host AS site, host AS dest OUTPUTNEW message AS description, updated
+| lookup phishing-filter-splunk path_wildcard_prefix AS vendor_url, host AS site, host AS dest OUTPUTNEW message AS description, updated
+| lookup pup-filter-splunk host AS site, host AS dest OUTPUTNEW message AS description, updated
+| lookup vn-badsite-filter-splunk host AS site, host AS dest OUTPUTNEW message AS description, updated
+| lookup botnet_ip dst_ip AS dest OUTPUTNEW malware AS description, updated
+| eval Description=description
 | search Description=*
 | eval updated=coalesce(updated, updated2, updated3, updated4, updated5, updated6, updated7), "Signature Last Updated"=strftime(strptime(updated." +0000","%Y-%m-%dT%H:%M:%SZ %z"),"%Y-%m-%d %H:%M:%S %z"), Time=strftime(_time, "%Y-%m-%d %H:%M:%S %z"), "Source IP"=src, Username=user, Domain=site, "Destination IP"=dest, URL=url, Action=action
 | table Time, index, "Signature Last Updated", "Source IP", Username, Domain, "Destination IP", Description, Action, URL