Difference between Queries ??

[Vishal2]

I have 2 search Queries to get the windows shutdown list from the lookup file but when  I run these 2 Queries I am getting different host list for same time period, Can you please suggest the best Query to get the shutdown hosts from the lookup file.

1. index=* host=* sourcetype=XmlWinEventLog* (EventCode=41 OR EventCode=1074 OR EventCode=6006 OR EventCode=6008) join type=inner host [ |inputlookup Windows.csv ] | stats count by host | dedup host

2. index=* sourcetype=XmlWinEventLog* EventCode=41 OR EventCode=1074 OR EventCode=6006 OR EventCode=6008 [ | inputlookup Windows.csv | return 1000 host] | stats count by host | where count >1

[kamlesh_vaghela]

@Vishal2 

In this case I will suggest this search,

index=* sourcetype=XmlWinEventLog* (EventCode=41 OR EventCode=1074 OR EventCode=6006 OR EventCode=6008) [| inputlookup Windows.csv | return 1000 host] 
| stats count by host 
| where count >1

and if I'm right you will have only those host which has events if you remove "| where count >1" from search.

KV