Hi @willemjongeneel,
After you stats command only available fields will be "value". If you need other fields (let's say threshold) as well you can do something like this:
index="index1"
| eval tijd = strftime(_time,"%w%H")
| lookup threshold.csv tijd output threshold
| stats dc(Request) as value, values(threshold) as threshold
| eval State=(case(value < threshold*0.25, "critical", value >= threshold*0.5, "normal", (value >= threshold*0.25 AND value < threshold*0.5), "warning"))
| table value, threshold, State
Hope this helps.
... View more