Need table o/p with each FROM_IP its related uid

Try this query. It’s not as efficient as your original query since it reads more rows, but sometimes it can’t be helped. We start by reading both connection and BIND events then putting them together using stats. Then we filter out those not in the lookup file.

index=name conn ("connection from" OR "BIND")
| stats values(*) as * by conn
| search [| inputlookup UIDlist.csv 
        |rename UID AS uid
        | return $uid ]
| rex field=_raw "connection from (?<FROM_IP>\d+\.\d+\.\d+\.\d+):"
| rex field=dn "uid=(?<uid>[^,]+)"
| stats count by FROM_IP, uid