Create a Lookup Definition against your KVStore called something like my_lookup_definition . Then create an Automatic Lookup to do this: ... | lookupmy_lookup_definition <Server Field Name In Lookup> <Server Field Name In Data> OUTPUT <Server Field Name In Lookup> AS _critical_temp Then create a Calculated Field like this: ... | eval critical=if(isnull(_critical_temp),"False", "True") OR Better yet, eliminate the need for a Calculated Field entirely by configuring your KVStore to have a field called critical with every row having a value of True and then in your Lookup Definition set a default value of False and make your Automatic Lookup like this: ... | lookupmy_lookup_definition <Server Field Name In Lookup> <Server Field Name In Data> OUTPUT critical ... View more