Figured it out. I added a new column ("mycount") in lookup2 with a "0" value for each entry. Then when I searched lookup2 against lookup1, for every row where there was no cve match between lookups, the cve was added with a "0" value. Final search: | inputlookup lookup_1
| table cveID asset Project product dueDate
| mvcombine delim=",", asset
| nomv asset
| eval numberCVEs=mvcount(split(asset,","))
| append
[ |inputlookup lookup_2
| fields q1-cveID, mycount
| eval cveID=q1-cveID ]
| dedup cveID
| eval numberCVEs=if(mycount=0, "0", numberCVEs)
| table cveID, q1-cveID asset Project product dueDate
... View more