https://community.splunk.com/t5/Alerting/Windows-alert/m-p/561275#M12173 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/236452">@Vishal2</a>&nbsp; You are expecting something like this? host_list is the lookup name having host field having pre-populated windows hosts in your org?</P><LI-CODE lang="markup">index=&lt;your_index&gt; source=WinEventLog* EventCode=41 OR EventCode=1074 OR EventCode=6006 OR EventCode=6008 [| inputlookup host_list | return 1000 host ] | stats count by host | where count &gt; 1</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Wed, 28 Jul 2021 23:30:10 GMT venkatasri 2021-07-28T23:30:10Z https://community.splunk.com/t5/Alerting/Windows-alert/m-p/561173#M10695 <P>By using below Query it's working for to find out the only one windows server but can you please post&nbsp; by using lookup containing all the hosts to Monitor.</P><P>&nbsp;</P><P><SPAN>index=&lt;your_index&gt; source=WinEventLog* EventCode=41 OR EventCode=1074 OR EventCode=6006 OR EventCode=6008&nbsp;</SPAN></P><P>| stats count by host&nbsp;</P><P>| where count &gt; 1</P> Wed, 28 Jul 2021 10:51:43 GMT https://community.splunk.com/t5/Alerting/Windows-alert/m-p/561173#M10695 Vishal2 2021-07-28T10:51:43Z https://community.splunk.com/t5/Alerting/Windows-alert/m-p/561275#M12173 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/236452">@Vishal2</a>&nbsp; You are expecting something like this? host_list is the lookup name having host field having pre-populated windows hosts in your org?</P><LI-CODE lang="markup">index=&lt;your_index&gt; source=WinEventLog* EventCode=41 OR EventCode=1074 OR EventCode=6006 OR EventCode=6008 [| inputlookup host_list | return 1000 host ] | stats count by host | where count &gt; 1</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Wed, 28 Jul 2021 23:30:10 GMT https://community.splunk.com/t5/Alerting/Windows-alert/m-p/561275#M12173 venkatasri 2021-07-28T23:30:10Z