I finally made it to work, first it was the evals made before the join occurs and then it was multiple if statement that needed to be checked. Bellow the code if that might someday help anyone and thank you for your replies richgalloway |inputlookup model_evaluation.csv | rename evaluation_metric as training_score | table model_name training_score
| join type=inner model_name
[|inputlookup model_evaluation_month.csv]
| eventstats max(training_score) as max_training
| eventstats max(evaluation_metric) as max_evaluation
| eval model_max_evaluation = if(tonumber(evaluation_metric) == tonumber(max_evaluation), model_name, "void")
| eval good_model_name = if(training_score == max_training and evaluation_metric >= 0.94, model_name, model_max_evaluation)
| dedup good_model_name
| where like(training_score, "%".max_training."%") OR NOT like(good_model_name, "void")
| eventstats count(model_name) as count_lines
| eval model_to_keep = if(count_lines > 1, if(training_score == max_training and evaluation_metric >= 0.94, "True", "False"), "None")
| search model_to_keep IN ("True", "None")
| table model_name
... View more