First and foremost - don't use join. There are some rare cases when join can be useful but this isn't one of them. As a rule of thumb - this is not SQL, joins are a no-no. Just do your  index=installed-apps (DisplayName IN (App1, App2, App3, App4)) | fields DisplayName host to get your initial "report" of the data from the index. Check if it's good. Now we use a neat trick to save ourselves the need to write all those evals. | eval have{DisplayName}=1 This way if you have an event where DisplayName was named "App1", you'll get a field called haveApp1 with a value of 1. Now you can simply do | stats values(have*) as * by host And you have the table from your indexed data. If you want to filter it by your lookup, you just do | lookup AD_servers.csv host output host as matched | search matched=* If you want to show rows even for hosts which are in the lookup but which aren't in your index, you'll have to go another way. Instead of immediately statsing your data you go | inputlookup append=t AD_servers.csv And now you can do your  | stats values(have*) as * by host ... View more