Like this: index=YouShouldAlwaysSpeciryAnIndex AND sourcetype=AndSroucetypeToo | stats count BY Name, Fruit | rename COMMENT AS "I believe that above is your existing search, so just add what is below" | evenstats values(Fruit) AS Fruits BY Name | search NOT Fruits = "Oranges" ... View more

And then again, it works as expected when I do it the other way round, start with the inputlookup for the whole table, then add the count for things that are found, then fill count with 0. I got no more duplicated ids then, as the count is correct for the ids found, 0 for non found. No appendcols, just append... | inputlookup your_lookup | append [ search sourcetype=serverevents [| inputlookup your_lookup | fields servername ] |stats count by servername] | stats first(*) as * by servername | fillnull count I double checked the result of that now within my data sets, this should be fine. ... View more

Thanks for your feedback. Wow, thats extremly disappointing... In an envíronment with having > 150.000 endpoints each may have several DHCP leases keeping logs up to 2 years > 1.5 TB Logfiles per day ... this is really a show-stopper. ;-( Fred ... View more