Hi @JARFB , this should help to get that, Index=cm_tool event_status= "Job Started"   OR event_status= "Job Completed"  |stats values(event_status) as event_status by job_id |  eval matches = if(match(event_status,"*Job Completed*"), 1, 0) |where match=0   Please upvote my response if this helps. ... View more

Hi @CSULeigh , not sure if I understand the  ask completely, but have you tried    | inputlookup somecsv.csv | join type=outer dayOfWeek [search index=someindex | eval dayOfWeek=strftime(_time, "%a")|eval found=1] |where isnotnull(found) ... View more

hi @umou7 , another option would be to write the session ids to summary index (you get this option when you create a report). However lookups are faster and you can use a KV store lookup which is faster than a lookup file.  logic for alert with lookup will be like : ...| table _time, sessionid, otherfield1 | join type=outer sessionid      [ search |inputlookup sessionhistory.csv         |table sessionid | eval found_in_history=1] | where isnull(found_in_history) |outputlookup sessionhistory.csv append=true   now set alert action as email when result count > 0   Remember, first time when you are create the lookup you have to run a query for all time to populate the sessionid in the lookup, after that above alert logic will keep appending.  ... View more

Hello @FraserC1 , this should work | index="automox" sourcetype="automox:devices" | dedup name | eval patch_pend=if(pending_patches>0, 1, 0) | eval patched=if(pending_patches=0, 1, 0) | stats sum(patch_pend) as patch_pend , count(name) AS total, sum(patched) as patched | eval %patch_pend=round((patch_pend*100/total),2) | eval %patched=round((patched*100/total),2) | fields %* | transpose   Hope it helps! Please upvote my response if it resolves this issue. ... View more