The idea is my hosts will write a status message to a log file that gets picked up by Splunk and put into a shared index with all others servers. I then want to go through a list of servers via an inputlookup to see when the last time they reported their status was. I can get the time diff to work, but I can't find a way to go through all my servers ie like a for loop. Any suggestions? input.csv: ServerName,Environment,App serverA,Prod,database serverB,Dev,webserver base search: index="server_health" "pulse_detected" | head 1 | eval tnow = now() | eval timediff = (tnow - _time)| eval timediff = timediff/60/60| convert ctime(tnow) |table _time,tnow,timediff I've tried various versions of this below and just can't wrap my head around how it should work 😞 |indexlookup server.csv | table Server [ index="server_health" "pulse_detected" | head 1 | eval tnow = now() | eval timediff = (tnow - _time)| eval timediff = timediff/60/60| convert ctime(tnow) |table _time,tnow,timediff} ] ... View more