If you don't know no. of rows in csv file then execute below two queries to delete last row in csv lookup | inputlookup <lookup_name> | stats count Now, use the count value in below query:: | inputlookup <lookup_name> | head count-1 | outputlookup <lookup_name>   ... View more

with group not work for me: used this: | tstats values(sourcetype) where index=* by index you can also try this one to get indexes based on provide sourcetype in query:: | tstats values(sourcetype) where index=* sourcetype="abc" OR sourcetype="xyz" by index   ... View more