how to use metadata to find the last reporting time of a list of hosts from a lookuptable without getting the "Metadata results may be incomplete: 100000 entries have been received from all peers" Warning

[pavanae]

The following is my query

| metadata type=hosts | search [| inputlookup hostnames.csv | rename my_hostname as host | eval host=lower(host)
| table host ]
| eval lastTime=coalesce(lastTime,0)
| eval timeDiff=now()-lastTime
| eval last_seen_in_24_hours=if(timeDiff>86400,"NO","YES")
| eval lastReported=if(lastTime=0,"never",strftime(lastTime,"%F %T"))
| stats count by last_seen_in_24_hours

Now, The issue is that I have around 1000 hosts in the csv file but from the above query i can able to see only 400 hosts's information and also seen the below warning on the job.

Now how to modify my current query to overcome that warning and display all the 1000 hosts reporting status ?

[somesoni2]

Seems like you've hit the limit of metadata command. You can try this alternative. You can use timerange for this query as last 24 hrs as you just want to know if the host's have sent data in last 24 hrs or not.
Updated

| tstats max(_time) as lastTime WHERE index=* [| inputlookup hostnames.csv | rename my_hostname as host | eval host=lower(host) | table host | format ] by host 
| inputlookup hostnames.csv append=t | eval lastTime=coalesce(lastTime,0)
| eval timeDiff=now()-lastTime
| eval last_seen_in_24_hours=if(timeDiff>86400,"NO","YES")
| eval lastReported=if(lastTime=0,"never",strftime(lastTime,"%F %T"))
| stats count by last_seen_in_24_hours

[pavanae]

Thanks for the response @somesoni2 . The above query ended with the following error

Error in 'TsidxStats': WHERE clause is not an exact query

[somesoni2]

Try the updated answer.

[pavanae]

still same error @somesoni2

[somesoni2]

That's strange. Similar query just works fine for me. Can you just run below and what result you get?

| inputlookup hostnames.csv | rename my_hostname as host | eval host=lower(host) | table host | format