Hi @jip31,
as I said, the best way is to use a different approach, but for test try invert the searches: put the search on index in main search and inputlookup in subsearch:
`wire`
| fields USERNAME NAME AP_NAME Building
| rename USERNAME as host
| eval host=upper(host)
| lookup test2.csv NAME as AP_NAME OUTPUT Building
| eval Building=upper(Building)
| stats last(Building) as "Geoloc" by host
| join host
[ | inputlookup host.csv
| table host] `disks`
| fields Type Name TotalSpaceKB FreeSpaceKB host
| eval time = strftime(_time, "%m/%d/%Y %H:%M")
| eval FreeSpace = FreeSpaceKB/1024
| eval FreeSpace = round(FreeSpace/1024,1)
| eval TotalSpace = TotalSpaceKB/1024
| eval TotalSpace = round(TotalSpace/1024,1)
| lookup test.csv HOSTNAME as host output SITE DESCRIPTION_MODEL ROOM COUNTRY
| stats latest(FreeSpace) as FreeSpace latest(TotalSpace) as TotalSpace values(DESCRIPTION_MODEL) as Model values(SITE) as Site values(COUNTRY) as Country by host
| where FreeSpace <= 132 AND TotalSpace >= 64
| eval FreeSpace=FreeSpace." GB", TotalSpace=TotalSpace." GB"
| rename FreeSpace as "Free space", TotalSpace as "Total space"
| search Country=France
]
| rename host as Hostname
| table Hostname "Free space" "Total space" Model Site Country "Geoloc"
| sort +"Free space"
Ciao.
Giuseppe
... View more