Hi @pm2012 , I suppose that you have the hostname field also in the main search, if not, you have to renabme that field. So if you want only the logs from hostnames that are in the lookup, you could try somethng like this: <your_search> [ | inputlookup customer_devices.csv | fields hostname ] | eval hostname=lower(hostname) | stats count BY hostname | append [ | inputlookup customer_devices.csv | eval hostname=lower(hostname), count=0 | fields hostname DeviceType count ] | stats sum(count) AS total values(DeviceType) AS DeviceType BY hostname | eval Status=if(total=0, "Non Active", "Active)  If instead you want to check also new hostnames that aren't in the lookup, you could try: <your_search> | eval hostname=lower(hostname) | stats count BY hostname | append [ | inputlookup customer_devices.csv | eval hostname=lower(hostname), count=0 | fields hostname DeviceType count ] | stats sum(count) AS total values(DeviceType) AS DeviceType BY hostname | eval Status=case(NOT DeviceType=*, "New hostname", total=0, "Non Active", total>0, "Active) Ciao. Giuseppe ... View more