Hi,  After reviewing most of the posts and not finding a solution. I finally came here to ask for help related to my query problem.  I have a lookup table which runs sweeps to check if logs are missing in any particular index/host. My query was working like a charm from last two years, but suddenly, it started to show FPs.  My query =  | inputlookup mylookuptable.csv | table index sourcetype host | join index sourcetype host type=left [| tstats count where index=* sourcetype=* host=* by _time index sourcetype host | stats count by index sourcetype host] | fillnull value=0 | search count = 0 Can someone please help me understand why its not displaying results for those values only if any index/sourcetype is missing logs? ... View more