Working on a query to generate an alert when a field value changes. The requirement is to detect the change in IP for a FQDN. Currently I'm trying to use a lookup file which has the current value of the IP for two FQDN per host.  Columns - Host|FQDN|Current_IP Looks something like Host1 fqdn1 IP1 Host2 fqdn1 IP1 Host1 fqdn2 IP2 Host2 fqdn2 IP2 I followed an approach suggested in another thread to use inputlookup My current query looks like - stats latest(IP) as Latest_IP | inputlookup append=true myfile.csv | stats first(Latest_IP) as Latest_IP, first(Current_IP) as Previous_IP | where Latest_IP!=Previous_IP   This gives me a result with the latest and previous IP whenever the IP changes, but looking to add more details to the result which also lists the FQDN and the time when the IP changed. ... View more