Try this:   index=My_log | stats count by Account_ID Cell_Number | lookup accountId.csv Account_ID output Account_ID as foundme | where Account_ID = foundme | table Account_ID Cell_Number     Notes: 1) You have to keep all the fields you need in the stats command somehow, or they will not exist afterwards. 2) When you output the lookup results, you need to give it a new name or you won't know whether it was found or not.   ... View more