index=DBG_SYS sourcetype=DBG_SYS msg="Shelf 1 congestion, resource cps level 2." OR msg="Shelf 1 slot * congestion, resource cpu level *" | rex field=msg "cpu level+\s(?<level>\d+)" | rex field=msg "cps level+\s(?<level>\d+)" | where level>0 | eval local_date_hour=strftime(_time,"%H") | stats by local_date_hour host msg | table local_date_hour host msg count(code) | rename count(code) as hits ] | rename local_date_hour as Hour | sort by Hour ... View more

I do not understand where I should put this. Should I keep my original search and add this? Then I will still get the same warning on my scheduled search every day. I have an OR statement in my search also so I need more information please. ... View more

This works also ... View more

Thanks for all the help! ... View more

Thank you for all the input. I am using the isnotnull option after the lookup, but I was hoping to use the lookup table as a filter. My base search results need to be filtered by 2 fields in the lookup table. If they match then I need only the raw events that match and add some data from the lookup table to the raw events that are left over. ... View more