`sample_source` and `sample_source_2` are macros and possible contain the indexes (and sourcetypes) being used. If you press <ctrl><shift>E when the search is in the search window, it will produce an expanded version of the search, so you will be able to see what the search macros actually expand to. ... View more

Thanks taht worked! ... View more

Hi @Tika, you could run something like this: your_search | rename "my_user.user_email" as email | mvexpand email | stats count by email | eval useremail= email."@my_domain.com" | append [ | inputlookup userdomain_email | rename email AS useremail | fields useremail ] | stats sum(count) AS total BY useremail | eval status=if(total=0,0,1) | table useremail status Ciao. Giuseppe ... View more