saifuddin, you can try in this way by loading up all the required host into a look up and append/join/lookup with the actual query for the host count(whcih represents host up or down) OR a particular message which lets you know host is down. | inputlookup listof_hosts_alerts.csv | append [search index= host=host* | stats count by host] | stats values(count) AS count by host | fillnull value=0 | eval status=case(count>0,"Up", count=0, "Down", 1=1, UNKNOWN) | fields - count | search status=Down ... View more