I have this query to find hosts from a lookup that have zero events. There are about a 100 hosts and I can see that the query performance is slow with the use of subquery this way.  Any ideas to improve this? | inputlookup lookup.csv | join type=outer [search index=os sourcetype=ps "abc.pid" OR "abc.bin" | stats count as heartbeat by host ] | fillnull heartbeat value=0 | where heartbeat=0 | stats values(host) as failed_hosts ... View more

I have a lookup table with an event name with min max thresholds I need to join this (left on the lookup) with the event count by with null fill on events not present in search lastly - I need rowwise comparison of event count against min / max and conditional format  coloring rows with counts out of band. I am able to left join the data but I am unable to proceed beyond that as I am not able to reference the attributes for any additional evals Any help or direction would be greatly appreciate: | inputlookup bk_lookup.csv | join type=left left=L right=R where L.alertCode = R.alertCode [search index=my_index log_group="/my/log/group" "*cache*" | rex field=event.message "alertCode: (?<alertCode>.*), version: (?<version>.*)" | stats count as invokes by alertCode] | table L.alertCode, R.invokes, L.min, L.max | fillnull value=0 R.invokes ... View more