Query to check all apps in lookup that haven't had an event in the last 90 days.

[Chris_Urman]

I have a lookup that has saved all apps installed on our deployment server. I need a query that checks all apps in the lookup without an app event in the last 90 days. Thank you for any assistance. 

[Chris_Urman]

Made a couple minor adjustments but this is what I needed to solve my issue. Thank you.

[ITWhisperer · Accepted solution]

Assuming your app name in the events is app and the app name in the lookup is also app, you could do something like this (over the past 90 days)

| stats count by app
| append
  [| inputlookup lookup]
| stats count by app
| where count == 1