Hi @apomona , with my search you have the list of servers where the EventCode 4776 is't present in the last two minutes. The other time is required to have (if present) the last occurrence of the event: index="ad_windows" EventCode=4776 earliest=-60m@m | eval period=if(_time>now()-120,"Last","Previous") | stats count(eval(period="Last")) AS count latest(_time) AS _time BY host | append [ | inputlookup DomainController.csv | eval count=0 | fields host count ] | stats sum(count) AS total latest(_time) AS _time BY host | where total=0 | eval _time=if(_time=0,"No events in the period",_time) | table host _time Ciao. Giuseppe ... View more

If no ever one has told before, you are awesome ^^ Thx  🙂 ... View more

Hey,  I just tried but I don't think this is working properly. ASSETtoken can be either Value1, Value2 or All. It is set by the user. If it is Value1, I want to use File1.csv, Value2=> File2.csv, All => File1 + File2. In both files there is a column called columnX Here is my code following your example:  | inputlookup File1.csv | inputlookup File2.csv | eval columnX=coalesce(File1.csv,File2.csv) | search columnX="$ASSETtoken$" | sort columnX | table columnX       ... View more