Thanks for the suggestion! I was also able to do what I wanted with the below search, but yours seems a bit more efficient. | inputlookup test.csv | search NOT [search index=exampleindex EventCode=4722 | stats by Target_Account_Name | rename Target_Account_Name as Account_Name | table Account_Name ]
... View more