Assuming both files use host as the field name, search like this: | inputcsv AntiVirusResults | eval source="AV" | appendpipe [| inputcsv ServerList | eval source="SL" ] | stats dc(source) AS numSources values(source) AS sources BY host Then add this to show hits: | search numSources=2 Or add this to show misses: | search sources="SL" AND numSources=1 ... View more

Try updating the same field or creating a new field - | eval Environment=case(Environment=="Backup", "Production", Environment=="Pre-Prod", "Production", Environment=="Production","Production",Environment=="Recipe", "Off Prod", Environment=="Development", "Off Prod", Environment=="Qualification","Off Prod", Environment=="Integration","Off Prod") OR | eval ENV=case(Environment=="Backup", "Production", Environment=="Pre-Prod", "Production", Environment=="Production","Production",Environment=="Recipe", "Off Prod", Environment=="Development", "Off Prod", Environment=="Qualification","Off Prod", Environment=="Integration","Off Prod") Note: Field names are case sensitive. ... View more