In your example, G01462 doesn't (completely) match any entry in either Resource or environment. Lookup requires an exact match (unless you define it as a wildcard lookup or CIDR). In the case of G01462-mgmt-foo, would you want the lookup to find either G01462 - QA or  G01462 - SIT or both?

did you find a solution ? also seem to be experiencing the same problem  in my case the username and password are the ones i used when installing splunk enterprise after accepting licence agreement. anyone?

Hi @ITWhisperer  yes that is resolved. No worries. @gcusello @ITWhisperer  please help This is the other issue which is related to csv dataset and lookup dataset. From this SPL: source="cmkcsv.csv" host="DESKTOP" index="cmk" sourcetype="cmkcsv" Getting output below Subscription  Resource  Key Vault  Secret  Expiration Date  Months BoB-foo  Dicore-automat  Dicore-automat-keycore Di core-tuubsp1sct  2022-07-28 -21 BoB-foo  Dicore-automat  Dicore-automat-keycore  Dicore-stor1scrt  2022-07-28 -21 BoB-foo  G01462-mgmt-foo  G86413-vaultcore  G86413-secret-foo   From this lookup: | inputlookup cmklookup.csv Getting output below Application environment appOwner Caliber Dicore - TCG foo@gmail.com Keygroup G01462 - QA goo@gmail.com Keygroup G01462 - SIT boo@gmail.com   Combine the two queries into one, where the output will only display results where the 'environment' and 'Resource' fields match. For instance, if 'G01462' matches in both fields across both datasets, it should be included in the output. How i can do this, could anyone help here to write spl. I wrote some of the Spls but it's not working for me. source="cmkcsv.csv" host="DESKTOP" index="cmk" sourcetype="cmkcsv" |join type=inner [ | inputlookup cmklookup.csv environment] source="cmkcsv.csv" host="DESKTOP" index="cmk" sourcetype="cmkcsv" | lookup cmklookup.csv environment AS "Resource" OUTPUT "environment"

Hi @gcusello  I checked the macros again and they contain the same values you listed earlier. Unless we've missed something, very basic they look in order. I've attached the screenshots of the macro configs. I believe they are correct? They were all self populated when the App was installed. There are no details about special settings for the index which I created via the WebUI with the suggested default index name. Thanks again  

Instead of dealing with the messiness of a natural language, it might be better to use standard notation of duration, like | fieldformat max(event.Properties.duration) = tostring('max(event.Properties.duration)', "duration") Instead of 40 mins , 30 mins or 1 hrs, you get 00:40:00, 00:30:00, 01:00:00, and so on.

Hi @slider8p2023, did you customized the three macros that are present in this app to populate the lookups? they are: `data_model_wrangler_index` Index to which summary data will be sent Default: data_model_wrangler `datamodel_wrangler_data_model_list` Comma separated list of data models to monitor Default: Authentication, Change, Change_Analysis, DLP, Databases, Email, Endpoint, Intrusion_Detection, Malware, Network_Resolution, Network_Sessions, Network_Traffic, Web `data_model_wrangler_health_review_lookup` The name of the lookup containing review information Default: data_model_wrangler_health_review.csv Put attention especially to the first  that contains the list of indexer to check. Ciao. Giuseppe

Hi @CarolinaHB, there are two solutions that depend on the  location of the monitoring perimeter: if you have a lookup containing the list of each app that should be present in each host (called e.g. app_perimeter.csv and containing at least two fields: host and application), you could run something like this: <your_search> | stats count BY host application | append [ | inputlookup app_perimeter.csv | eval count=0 | fields host application count ] | stats sum(count) AS total BY host application | eval status=if(total=0,"Missing","Present") | table host application status If instead you don't have this lookup and you want to compare results e.g. of the last 24 hours with the results of the last 30 days, you could run something like this: <your_search> earliest=30d latest=now | eval period=if(_time>now()-86400,"Last day","Previous days") | stats dc(period) AS period_count values(period) AS period BY host application | eval status=if(period_count=1 AND period="Previous days","Missing","Present") | table host application status Ciao. Giuseppe