I just came to the realization that this query shows "missing" when it's either missing in Splunk or exists in Splunk but not in the export: index=_internal | fields host | dedup host | eval host=lower(host) | append [ | inputlookup Export.csv | rename Hostname as host | eval host=lower(host)] | stats count by host | eval count=count-1 | eval Status=if(count=0,"Missing","OK") | sort Status | table host Status What I would like is to change the query to show where it's missing. ... View more