How to incorporate metadata command in my lookup table to be able to view time offline?

[chadman]

I have a few searches I have added a lookup table to. All of them work, but one. The one below uses metadata and I'm not sure how to make it work with the lookup table. My goal it to find host that have not connected in the last 5 min.

| metadata  [| inputlookup Meeting_Rooms | fields host] | eval age = now()-lastTime | where age > 50  | convert ctime(lastTime) | eval field_in_ddhhmmss=tostring((age) , "duration") |rename field_in_ddhhmmss as "Time Offline" lastTime as "Last Time" | sort + "lastTime" | table host "Time Offline" "Last Time"

This is not getting any results. If I replace [| inputlookup Meeting_Rooms | fields host] with type=hosts it works fine, but will show all host. Any ideas how I can make this work with my lookup table?

[chadman · Accepted solution]

I think I have it working with this.

| inputlookup Meeting_Rooms | join type=left host [metadata type=hosts] | eval age = now()-lastTime | where age > 50  | convert ctime(lastTime) | eval field_in_ddhhmmss=tostring((age) , "duration") |rename field_in_ddhhmmss as "Time Offline" lastTime as "Last Time" | sort + "lastTime" | table host "Time Offline" "Last Time"