Hi, Sure so i have 15 different .csv's all named differently. policy.csv audit.csv The files all contain the columns: Configuration Item Configuration Setting DNS,Enabled IOC,Disabled **Note - I can't combine the csv's together because there would be duplicate fields i.e exist in more than one file. My search is as follows: Index=main sourcetype="data" type=policy ''' the type basically exists in every csv file, coincidently the csv's are named by the type, i.e policy.csv. |rename dns as DNS ioc AS IOC customerId as companyId |table DNS IOC companyId | join companyId [| dbxquery query="SELECT companyId FROM table_systems WHERE status =1 connection="live_Db"] My results (before the input lookup) look like this in a table IOC DNS companyId false true man0000 What i would like is Configuration Item Default Current or Live companyId IOC Enabled disabled or False man0000 Thank you in advance
... View more