I did some headslamming and realized I could just do this. Might not be the most efficient so still open to critiques, but this got me the results I wanted! index=windows source=service
[inputlookup Windows_App_Services.csv | table host Name | makemv delim=:: host | mvexpand host]
| stats count(eval(if(State!="Running",1,null()))) as failureCount by host Name
| lookup Windows_App_Services_Lookup host Name
| join host Name type=outer [inputlookup Windows_App_Services.csv | makemv delim=:: host | mvexpand host]
... View more