I am trying to determine the the successful UF deployments other than an incremental count from the forwarder manager. I am using an inputlookuP(CSV) for an initial search which returns me the hosts from the inputlookup. I also want to list from the same inputlookup hosts that have not returned a result in the same table. my search that works thus far. index="_internal" source="*metrics.lo*" group=tcpin_connections fwdType=uf [ |inputlookup winunixtestinput.csv| fields hostname ]| dedup hostname| table hostname,sourceIp,fwdType,guid,version,build,os,arch I do not seem to be able to add the seconds part of the search to list the hosts that didn't return.   ... View more