I've found the solution using function "map" working as a loop interaction. | makeresults count=5000 | streamstats count as rownum | eval SavedDay=strftime(now(),"%Y%m%d") | eval InitialDay = "20200101" | eval DiffDay = "-".rownum."d@d" | eval SavedDay=strftime(relative_time(now(),DiffDay),"%Y%m%d") | where SavedDay >= InitialDay | join type=left SavedDay[| inputlookup "my_lookup.csv"                            | dedup SavedDay                            | eval ExistsDay = 1] | where isnull(ExistsDay ) | rename SavedDay  | where SavedDay >= "20190101" and SavedDay < strftime(now(),"%Y%m%d") | table SavedDay | map search="search index=ans sourcetype=\"my_source\" earliest=1 | eval year = strftime(strptime(CreationDate,\"%Y-%m-%d %H:%M:%S\"),\"%Y\") | where year>=2020 | eval Day=$SavedDay$ | where Day>= strftime(strptime(UpdateDate,\"%Y-%m-%d %H:%M:%S\"),\"%Y%m%d\") | stats max(UpdateDate) as UpdateDatef by Ticket Day | join type=left Ticket Day [| inputlookup \"my_lookup.csv\" | eval IsIn = 1] | where isnull(IsIn) . . . | table Ticket Day CreationDate UpdateDate" | table Ticket Day CreationDate UpdateDate A little bit annoying because the double-quote and escape, but it works!   Javier ... View more