Thanks @somesoni2 for your response. I used Lookup approach to resolve the issue. Figured it was easy to manage Lookup file. Here is how I did it: | inputlookups Events.csv | eval count=0 | append [search xyz [inputlookup Events.csv] | stats count by name] | stats sum(count) as total by name | eval status=if(total>0,"Yes","No") here my Lookup file has list of all event names that I want to monitor and need status as Yes/No depending if they occurred in given time frame. ... View more