Hi I have a query which finds hosts without logs for the whole search and it looks like this: | inputlookup hosts.csv | search NOT [search index=prod ("successfully placed") | dedup host | table host] What I would like to be able to do is to split this over _time so that I can search for say "over the last 24 hours, which minutes have no logs by host". I've tested with trying to squeeze in "bucket _time span=1m" but I can't figure out how to combine this with my host.csv lookup. Anyone got any tips? ... View more