Hi Everyone, I am trying to use  a lookup table and an index to get an output as a comparison of two fields from two different sources lookup has a field that is in the format like this (fieldA) aaa ddd fff index has a field that is in the format like this (fieldB) aaa.ccc.com ddd.ccc.com eee.ccc.com index=stream_dns dest_asset_tag=*dns OR dest_asset_tag=A | append [| inputlookup dnslookup.csv | table fieldA | rename fieldA as fieldB ] | stats count by  dest, fieldB The result should look like the missing fields from comparison of fieldA and fieldB in this format eee fff ... View more