I found the answer. "search" is missing. Use | tstats count where index = _* by host | search NOT [inputlookup forwarders.csv | fields+ host] | stats values(host) AS new_hosts ... View more

I get the same error, "Search Factory: Unknown search command 'not'." ... View more