I'm currently trying to find workstations that haven't been logged into by a human over a period of time. My first query is  index=windows host=ch0cswop002 | stats values(ComputerName) as computers That correctly gets me a list of all the windows workstations that are sending us logs. My second query search index=windows host=ch0cswop002 EventCode=4624 Logon_Type=10 OR Logon_Type=2 user!=DWM-* user!=UMFD-* | stats count by ComputerName correctly gives me the number of times any human logged into a specific ComputerName When I combine the two   index=windows host=ch0cswop002 | stats values(ComputerName) as ComputerName | eval count = 0 | join type=outer ComputerName [search index=windows host=ch0cswop002 EventCode=4624 Logon_Type=10 OR Logon_Type=2 user!=DWM-* user!=UMFD-* | stats count by ComputerName] | where count == 0 | table ComputerName   I get a list of all the computers.  If I table ComputerName,count I see only a single count value of zero for the first result. Does my error jump out for anyone or know a better way of doing this? ... View more