Try this:   | inputlookup csvfilename.csv | eval host=Hostname | append [| metadata type=hosts index=_* ] | stats max(*) as * by host | eval status=if(lastTime>relative_time(now(), "-30d"), "Receiving log", "No log can be found from past 30days") | table host, IP, status If this reply helps you, an upvote/like would be appreciated.   ... View more

Thanks for your response. I picked 1 of the IOC in the list and tried to search on Threat Artifacts which can be found. But both threat_group and threat_category is undefined. May I know if it will cause any problem? ... View more

The dashboard gets its data from a KVStore lookup (licensing_epd).  If the data in that lookup is inaccurate then so will the dashboard.  See the Audit - Events Per Day - Lookup Gen saved search for how the lookup is populated. ... View more