Hi @sfurkan, you have to update the timestamp in a lookup with two columns: host last connection, when a condition is trggered, you could run something like this: index=your_index your_condition | eval host=lower(host) | stats latest(_time) AS latest BY host | append [ | inputlookup | eval host=lower(host) | fields host latest ] | stats max(latest) As latest By host | outputlookup your_lookup In other words, you have to take the values from the search and from the lookup modifying only the values from the main search and savinf the results in the loolup. If you could share your alert's search and the fields of your lookup I could be more precise Ciao. Giuseppe ... View more

I noticed and fixed my query after posting. I think you read before my edit. Please check my reply again. I changed it to src_user. It will compare user field in csv with src_user in events. ... View more