After much back and forth I figured it out. My subsearches were not properly ordered...
| metadata type=hosts
| dedup host
| eval "Last Logged Date"=strftime(recentTime, "%+")
| eval "Days Since Last Logged"=round((now() - lastTime)/86400)
| search "Days Since Last Logged"<=30
| eval host=lower(host)
| search NOT
[| asset_eventcount
| search ( get_category(*) ) ()
| sort 0 - lastTime
| uitime(firstTime)
| uitime(lastTime)
| eval last_logged = round((now() - lastTime)/86400)
| replace -1 with 0 in last_logged
| eval last_logged = if(last_logged<30, "Logging", last_logged)
| eval last_logged = if(last_logged>30, "Stopped Logging", last_logged)
| eval last_logged = if(isnull(last_logged) OR last_logged="", "Never Logged", last_logged)
| table ip,mac,nt_host,dns,owner,bunit,category,pci_domain,is_expected,firstTime,lastTime,last_logged
| search last_logged="Logging"
| fields nt_host
| rename nt_host as host] | stats dc(host)
... View more