Thanks! That helped me get past this. The 30 devices are provided by two vendors that each provide a field for health monitoring, so I actually joined two other searches once I got this part cleared up, and the lookup is what I needed to bridge the different IDs and SNs. Here's the final:
| inputlookup myLookup.csv
| append [search index="myApplication" “myAppMessage1"]
| lookup myLookup.csv deviceId OUTPUT deviceName, sortNumber, deviceSN
| join type=left deviceName [search index="myApplication" “myAppMessage2"
| eval deviceHealth=round(deviceHealth,1)
| lookup myLookup.csv deviceSN OUTPUT deviceName, sortNumber, deviceId]
| join type=left deviceName [search index="myApplication" “myAppMessage3"
| eval deviceHealth =round(deviceHealth,1)
| lookup myLookup.csv deviceSN as serialnumber OUTPUT deviceName, sortNumber, deviceId]
| stats last(deviceName) as deviceName, last(deviceId) as deviceId, count(deviceEvents) as eventCount, min(deviceHealth) as deviceHealth by sortNumber
| sort + sortNumber
| fields - sortNumber
... View more