If we're only interested in yesterday and today then there's no need to look back 30 days.  We'll look at two days, find the difference between them, and trigger an alert if there is one. | inputlookup program_version.csv | where date>=relative_time(now(), "-1d@d") | eval _time=date | timechart max(count) as count by version | eventstats range(count) as diff | where diff!=0 ... View more

It should work, I tried it out with csv file you shared.  It can either be permissions (but you're able to see contents of lookup using inputlookup).  Check the fieldnames (case-sensitive) & also spell-check Try another way (replace with your filename) -  | inputlookup answers-571716.csv | where failcode="g-ab" OR failcode="c-cd" OR failcode="d-dd"   ... View more

Thank you! This worked perfectly.  ... View more

Thank you! That was good advice. For future finders of this post you would replace the following: From:  | rex field=fail_code "(?<fail_code_name>[^\[]+)"   To this:  | rex field=fail_code "(?<fail_code_name>^.{2}+)"   ... View more

@to4kawa So I guess I need to wrap my head around the idea of these drilldowns better. If I wanted to have the user able to click on a given datapoint on a certain day on a line chart to drilldown and display the event detail data it contains I should first set a token for the token to click based on the category of the datapoint itself? Then the drilldown query will run a separate query to search the lookup table and then use the search command with the category I want it to drilldown on with the newly created token?  Thanks again for your help! ... View more