Seems likely the subsearch is running out of space or time. There's an easy way to invert the search, though, so that won't happen. Try running this version ... if it gets the same result, then use it instead, and add the outputlookup on the end. index=onelogin event_type_id=5 | eval mytime=strftime(_time, "%Y-%m-%d") | lookup idstoroles.csv user_id | stats distinct_count(mytime) as logcount by role_name, user_name, user_id | where like(role_name, "%External User%") | append [ | inputlookup idstoroles.csv | where like (role_name,"%External User%") | table role_name, user_name, user_id | eval logcount=0 ] | stats sum(logcount) as "total logins" by role_name, user_name, user_id ... View more

@svemurilv try this, your search here | eval result_users = case("message.device.category" == "Mobile", "Mobile","message.device.category" == "Desktop", "Desktop","message.device.category" == "Tablet", "Tablet") | stats count by result_users ... View more