Thank you for following up. The first search that creates the csv lookup file is similar to what I have below. It creates the csv after Output results to lookup. File8 and File9 are values not expected that were added. index=log source="/logs/file_tracking.log" (AccountName IN("Account1") AND Filename IN (("File1*","File2*","File3*","File4*","File5*","File6*","File7*”, “File8*”, “File9*")) | table AccountName, Filename The 2nd search is similar to: index=log source="/logs/file_tracking.log" (AccountName IN("Account1") AND Filename IN (("File1*","File2*","File3*","File4*","File5*","File6*","File7*”)) | stats count BY AccountName Filename | append [ | inputlookup Filenames.csv | eval count=0 | fields AccountName Filename count ] | stats sum(count) AS total BY AccountName Filename | where total=0  They both return the same exact results (28) but the 2nd search has a 3rd column that shows a total of 0   ... View more

Unfortunately it's still the same output for me when running both searches. I've even tried to modify the filename search to look for values that I know don't exist.  ... View more

I agree with adding the account name since there is a relationship between them in my search, but the output is still the same.  They both return the same results after this recent change, listing all the files that were found. Thanks. ... View more

Thanks. There are results now with the updated search but the results are NOT for the missing files. Instead the new search lists almost the same files as the csv but drops a few of them. 67 files in the csv and 58 in the new search. ... View more

Buongiorno Giuseppe, Thanks for the feedback. I created a new csv with just filenames for lookup, also created the new search you suggested too.  However it didn't produce any results when it ran. Tried it a few times since after modifying the search to add the faux filenames from my post and still getting an output of 0 results each time.  ... View more