Hi , I used below query but not getting any output - I have lookup table dc.csv with host, IP field. Could you please look and advise    | metadata index=_internal | eval host=lower(host) | stats count BY host | append [ | inputlookup dc.csv |eval host=lower(host), count=0 | fields host IP count ] | stats sum(count) AS total value(IP) AS IP BY host | eval IP=if(isnull(IP),"Not present in lookup",IP), status=if(total=0,"Missing","Present") | table host IP status       ... View more

Sounds like you are on the right track. Glad to have helped! Good luck. ... View more