Hi @krbalaji77, sorry! it was a typo: index=os sourcetype=ps "abc.pid" OR "abc.bin" | eval host=lower(host) | stats count BY host | append [ | inputlookup lookup.csv | eval host=lower(host), count=0 | fields host count ] | stats sum(count) AS total BY host | where total=0 Ciao. Giuseppe ... View more

Thanks a bunch @yuanliu . This is perfect. I was not aware of the values function.  Also I had the threshold named min and max that kind a of added to the confusion as well. @woodcock  - Thank you for the clear direction as well.  Appreciate both your help. ... View more