Hi @gcusello Sorry perhaps i was not being very clear - i ommited some search strings on there so apologies. The csv is like this Configuration Item, Configuration Setting Boss, On Rogue,Off Report,Off The results come back like this in the search: config: [ [-] { [-] displayName: Remote Script Orchestration name: rso ..... ...... comapanyid:xxxx The company ID i get to match by doing a dbxquery, please see the full search below index=main sourcetype="_stats" type="add-ons" | spath config{} | mvexpand config{} | spath input=config{} | lookup add-ons.csv "Configuration Item" as displayName OUTPUTNEW "Configuration Setting" as "default" |rename cust as company |rename customerName as Customer | join company [| dbxquery query="SELECT * FROM systems WHERE status IN ('1') AND (sT=28) AND owner IN ('1','2')" connection="conn" ] |stats list(type) as type list(displayName) as item list(name) as value list(default) as default list(owner) as owner by company So if there is a mismatch form the results in the search to the csv then i would receive a result of the variables in the stats. What i also need to do is: lets say that in the search results there is no entry for Report,Off but this exists in the csv, i'd want to know about it so that i can go to that particular customer and turn it on, only then it will be visibile in the data we receive back from them. Thanks, Greg
... View more