Something like this should work. I called the lookup db_names.csv ... change that to whatever your actual lookup is named. Everything above the comment just emulates the data you gave. | makeresults count=1
| eval _raw="DatabaseName,Instance,CPUUtilization
A,A1,10
A,A2,20
C,C1,40
C,C2,50
D,D,60"
| multikv forceheader=1
| fields - _time, _raw, linecount
```^^^^ This emulates the data you gave ^^^^```
| eval inst_cpu=Instance+"#"+CPUUtilization
| fields - Instance CPUUtilization
| inputlookup db_names.csv append=true ```<-- change the lookup name here```
| stats list(inst_cpu) as inst_cpu by DatabaseName
| mvexpand inst_cpu
| eval Instance=mvindex(split(inst_cpu,"#"), 0)
| eval CPUUtilization=mvindex(split(inst_cpu,"#"), 1)
| fillnull value="NULL" Instance CPUUtilization
| fields - inst_cpu
... View more