Hi @karthi2809, at first rename your field before the stats command, then don't use append but the lookup command (https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Lookup). index=...
See more...
Hi @karthi2809, at first rename your field before the stats command, then don't use append but the lookup command (https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Lookup). index="mulesoft" environment=PRD
| rename
content.payload.Status AS Status
content.payload.InterfaceName) AS payLoadInterface
content.payload.ErrorMessage AS ErrorMsg
| lookup link.csv Link InterfaceName AS payLoadInterface OUTPUT Link
| stats
values(payLoadInterface) AS payLoadInterface
values(ErrorMsg) AS ErrorMsg
earliest(timestamp) AS Timestamp
values(priority) AS Priority
values(tracePoint) AS Tracepoint
values(Link) AS Link
values(payLoadInterface) AS payLoadInterface
BY correlationId
| eval
names=if(isnull(mvfind(message,"DISABLED")),null,message),
Response=coalesce(SuccessResponse,Successresponse,msg,names,ErrorMsg),
payLoadInterface=coalesce(Interface,payLoadInterface)
| table Status Timestamp InterfaceName Link Response correlationId message Priority Tracepoint
| search payLoadInterface="*"
| sort -Timestamp Then the condition Status LIKE (,"%") is wrong, what do you want to check?. Ciao. Giuseppe