Currently, this is my SPL query and it just displays different results this is my hostname_list.csv host hostname_a* hostname_b* hostname_c* | inputlookup hostname_list.csv | fields host | join type=inner host [search index=unix | stats latest(_time) as latest_time, latest(source) as source, latest(_raw) as event by host | convert ctime(latest_time) as latest_time] | table host, latest_time, source, event and it displays like this one: host latest_time source event hostname_a*       hostname_b*       hostname_c*       I assume that the wildcard "*" is acting like a literal string. I'm expecting results like this. host latest_time source event hostname_a12 test test test hostname_a23 test test test hostname_c123 test test test please help thanks! ... View more