@johnhuang It doesn't appear to be evaluating the is_excluded field properly. Could it be related to the end_time field becoming multi value after the lookup? Just to confirm, here is the setup I have based on your instructions: Search: |tstats summariesonly=true allow_old_summaries=true count(device.status) as count from datamodel=Devices.device where device.status!="" AND device.customer="*" AND device.device_id ="*" by device.customer, device.device_id, device.name, device.status _time span=30m |eval excluded=1 |lookup Historical_Uptime_Blacklist.csv excluded OUTPUT start end note | eval end_time=strptime(end, "%Y-%m-%dT%H:%M:%S.%3N%z") | eval epoch1=_time | eval is_excluded=IF(_time<end_time, "Y", "N") | search is_excluded="*" Lookup Table: Historical_Uptime_Blacklist.csv type start end device excluded note time 2022-10-04T13:10:30.000-04:00 2022-10-04T14:10:30.000-04:00 1 test range 10-04-2022 1:30 through 2:10 in EST UTC-4 device 1234 1 0 timedevice 2022-10-04T13:10:30.000-04:00 2022-10-04T14:10:30.000-04:00 1234 1 0 time 2022-10-05T13:10:30.000-04:00 2022-10-06T14:10:30.000-04:00 1 test range 10-06-2022 1:30 through 2:10 in EST UTC-4 device 00-10-7f-75-bf-b4_-1 1 DSG 'MTR-CP-B510' Test Lookup Definition: And lastly here is some sample data that I believe displays the issue. Based on the search, I would have expected that first entry to have been is_excluded=Y (Pasted as CSV due to the forum detecting HTML and reformatting the table.) device.customer,device.device_id,device.name,device.status,_time,count,end,end_time,epoch1,excluded,is_excluded RootIntegration,00-10-7f-de-0f-12_-1,TSW-1060-00107FDE0F12,Online,10/4/2022 0:00,20,2022-10-04T14:10:30.000-04:00,1664907030,1664856000,1,N ,,,,,,2022-10-04T14:10:30.000-04:00,1664907030,,, ,,,,,,2022-10-06T14:10:30.000-04:00,1665079830,,, RootIntegration,00-10-7f-de-0f-12_-1,TSW-1060-00107FDE0F12,Online,10/4/2022 0:30,23,2022-10-04T14:10:30.000-04:00,1664907030,1664857800,1,N ,,,,,,2022-10-04T14:10:30.000-04:00,1664907030,,, ,,,,,,2022-10-06T14:10:30.000-04:00,1665079830,,, RootIntegration,00-10-7f-de-0f-12_-1,TSW-1060-00107FDE0F12,Online,10/4/2022 1:00,21,2022-10-04T14:10:30.000-04:00,1664907030,1664859600,1,N ,,,,,,2022-10-04T14:10:30.000-04:00,1664907030,,, ,,,,,,2022-10-06T14:10:30.000-04:00,1665079830,,, RootIntegration,00-10-7f-de-0f-12_-1,TSW-1060-00107FDE0F12,Online,10/4/2022 1:30,22,2022-10-04T14:10:30.000-04:00,1664907030,1664861400,1,N ,,,,,,2022-10-04T14:10:30.000-04:00,1664907030,,, ,,,,,,2022-10-06T14:10:30.000-04:00,1665079830,,, Thanks for your assistance with this!
... View more
