How search for metrics for items not on within last 90 days?

[willsy]

Hello,

Trying to complete a search that uses metrics to monitor when a device has not been connected for the last 90 days.

| mcatalog values(id) WHERE index=AM AND metric_name=CN AND type="device" by id | table id

This shows the devices that are currently connected.

I have an input lookup with the device inventory as Device_Inv.csv

Is there a way to create a search that looks at the lookup table and uses metrics to see if it has not been online for 90 days or above?

Many thanks

[willsy]

Absolute champion or as your tag says esteemed legend. I needed the append=true and the logic of how to do it. thank you so much

[woodcock · Accepted solution]

https://www.duanewaddle.com/proving-a-negative/