https://community.splunk.com/t5/Splunk-Search/How-to-add-a-variable-from-a-lookup-table-to-filter-results/m-p/653811#M225952 <P>Use a subsearch.</P><LI-CODE lang="markup">| tstats latest(_time) as lastseen where (index=windows) [ | inputlookup hostlist.csv | fields host | format ] by host | convert ctime(lastseen)</LI-CODE> Wed, 09 Aug 2023 19:54:59 GMT richgalloway 2023-08-09T19:54:59Z https://community.splunk.com/t5/Splunk-Search/How-to-add-a-variable-from-a-lookup-table-to-filter-results/m-p/653810#M225951 <P>I am trying to do a tstats command to get the last logged time a server has sent logs.&nbsp; My server list i want in the table is in a lookup csv.</P> <P>The command i am using is&nbsp;</P> <P>Tstats latest(_time) as lastseen where (index=windows) by host | convert ctime(lastseen)</P> <P>The "where" clause i would like to be something like "where the server name is on the lookup table"</P> <P>&nbsp;</P> <P>Basically trying to filter the output of the query to just any server i have in the lookup table</P> Thu, 10 Aug 2023 21:35:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-a-variable-from-a-lookup-table-to-filter-results/m-p/653810#M225951 Gggflyer 2023-08-10T21:35:15Z https://community.splunk.com/t5/Splunk-Search/How-to-add-a-variable-from-a-lookup-table-to-filter-results/m-p/653811#M225952 <P>Use a subsearch.</P><LI-CODE lang="markup">| tstats latest(_time) as lastseen where (index=windows) [ | inputlookup hostlist.csv | fields host | format ] by host | convert ctime(lastseen)</LI-CODE> Wed, 09 Aug 2023 19:54:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-a-variable-from-a-lookup-table-to-filter-results/m-p/653811#M225952 richgalloway 2023-08-09T19:54:59Z