I was able to download the file you linked. This is possible with the current formatting in that file, but it would be simpler and more sustainable if you did not create a column for each class (W7, W8, and W10) and instead put that in a single column called expectedversion or something. The version class can be extracted from the name to create the class field. Here's how I transformed that lookup file that you linked:
| inputlookup patch_in_late.csv
| eval latepatch=mvappend(W10,W7,W8)
| fields + latepatch month
| mvexpand latepatch
| rex field=latepatch "^(?<versiontype>W\d+)P(?<version>\d+)"
| eval versionlate=tonumber(version)
That transforms your table from this: 
To this:
Now that you have the table adjusted you can perform a join to the first search to create the "patch_in_late_count" field you are looking for. Here's a run anywhere example demonstrating this:
| makeresults count=1
| eval host="host1"
| eval "Current Patch level" ="W10P039.$w$"
| eval month=strftime(now(), "%B")
| rex field="Current Patch level" "^(?<versiontype>W\d+)P(?<version>\d+)"
| eval version=tonumber(version)
| eval joiner=versiontype.month
| join type=left joiner
[| inputlookup patch_in_late.csv
| eval latepatch=mvappend(W10,W7,W8)
| fields + latepatch month
| mvexpand latepatch
| rex field=latepatch "^(?<versiontype>W\d+)P(?<version>\d+)"
| eval versionlate=tonumber(version)
| eval joiner=versiontype.month
| table joiner versionlate latepatch]
| eval patch_in_late_count=if((versionlate-version)>0, versionlate-version, "Up to date!")
| table host "Current Patch level" latepatch patch_in_late_count
| rename latepatch as "Expected Patch Level"
And here's how I think it will fit with the query you provided as long as the lookup file you attached is indeed the same data you will be using in your search:
| inputlookup host.csv
| lookup patchlevel.csv "Computer" as host
| stats count by host flag_patch_version
| where isnotnull(flag_patch_version)
| rename host as Hostname, flag_patch_version as "Current Patch level"
| fields - count
| table Hostname "Current Patch level"
| sort +"Current Patch level" limit=10
| eval month=strftime(now(), "%B")
| rex field="Current Patch level" "^(?<versiontype>W\d+)P(?<version>\d+)"
| eval version=tonumber(version)
| eval joiner=versiontype.month
| join type=left joiner
[| inputlookup patch_in_late.csv
| eval latepatch=mvappend(W10,W7,W8)
| fields + latepatch month
| mvexpand latepatch
| rex field=latepatch "^(?<versiontype>W\d+)P(?<version>\d+)"
| eval versionlate=tonumber(version)
| eval joiner=versiontype.month
| table joiner versionlate latepatch]
| eval patch_in_late_count=if((versionlate-version)>0, versionlate-version, "Up to date!")
| table Hostname "Current Patch level" latepatch patch_in_late_count
| rename latepatch as "Expected Patch Level"
I was able to download the file you linked. This is possible with the current formatting in that file, but it would be simpler and more sustainable if you did not create a column for each class (W7, W8, and W10) and instead put that in a single column called expectedversion or something. The version class can be extracted from the name to create the class field. Here's how I transformed that lookup file that you linked:
| inputlookup patch_in_late.csv
| eval latepatch=mvappend(W10,W7,W8)
| fields + latepatch month
| mvexpand latepatch
| rex field=latepatch "^(?<versiontype>W\d+)P(?<version>\d+)"
| eval versionlate=tonumber(version)
That transforms your table from this:
To this:
Now that you have the table adjusted you can perform a join to the first search to create the "patch_in_late_count" field you are looking for. Here's a run anywhere example demonstrating this:
| makeresults count=1
| eval host="host1"
| eval "Current Patch level" ="W10P039.$w$"
| eval month=strftime(now(), "%B")
| rex field="Current Patch level" "^(?<versiontype>W\d+)P(?<version>\d+)"
| eval version=tonumber(version)
| eval joiner=versiontype.month
| join type=left joiner
[| inputlookup patch_in_late.csv
| eval latepatch=mvappend(W10,W7,W8)
| fields + latepatch month
| mvexpand latepatch
| rex field=latepatch "^(?<versiontype>W\d+)P(?<version>\d+)"
| eval versionlate=tonumber(version)
| eval joiner=versiontype.month
| table joiner versionlate latepatch]
| eval patch_in_late_count=if((versionlate-version)>0, versionlate-version, "Up to date!")
| table host "Current Patch level" latepatch patch_in_late_count
| rename latepatch as "Expected Patch Level"
And here's how I think it will fit with the query you provided as long as the lookup file you attached is indeed the same data you will be using in your search:
| inputlookup host.csv
| lookup patchlevel.csv "Computer" as host
| stats count by host flag_patch_version
| where isnotnull(flag_patch_version)
| rename host as Hostname, flag_patch_version as "Current Patch level"
| fields - count
| table Hostname "Current Patch level"
| sort +"Current Patch level" limit=10
| eval month=strftime(now(), "%B")
| rex field="Current Patch level" "^(?<versiontype>W\d+)P(?<version>\d+)"
| eval version=tonumber(version)
| eval joiner=versiontype.month
| join type=left joiner
[| inputlookup patch_in_late.csv
| eval latepatch=mvappend(W10,W7,W8)
| fields + latepatch month
| mvexpand latepatch
| rex field=latepatch "^(?<versiontype>W\d+)P(?<version>\d+)"
| eval versionlate=tonumber(version)
| eval joiner=versiontype.month
| table joiner versionlate latepatch]
| eval patch_in_late_count=if((versionlate-version)>0, versionlate-version, "Up to date!")
| table Hostname "Current Patch level" latepatch patch_in_late_count
| rename latepatch as "Expected Patch Level"
