Hello,   I have got the solution to this. We need to first create results and initialize the count as 0. it will create one table with 4 rows. Then join that with the other lookup files. Below is the query that I have used: | makeresults | eval threat_key="p_default_domain_risklist_hrly" | eval count=0 | append [| makeresults | eval threat_key="p_default_hash_risklist_hrly" | eval count=0 ] | append [| makeresults | eval threat_key="p_default_ip_risklist_hrly" | eval count=0] | append [| makeresults | eval threat_key="p_default_url_risklist_hrly" | eval count=0 ] | fields - _time | append [| inputlookup ip_intel | search threat_key=*risklist_hrly* | stats count by threat_key ] | append [| inputlookup file_intel | search threat_key=*risklist_hrly* | stats count by threat_key ] | append [| inputlookup http_intel | search threat_key=*risklist_hrly* | stats count by threat_key ] | stats sum(count) as count by threat_key | search count=0   ... View more

We got this resolved. We installed app on SH and added index having data from add-on in the macro shown in below screenshot We started getting data in the index because the app has savedsearches that runs on the basis of macro and outputlookup it to the kv store.  ... View more