I have fields aa, bb, cc, dd, hostname and sometime few filed value may be null in payload. What i want to do. if (aa, bb is not null) than lookup abc.csv name output name hostname ip if (cc, dd is not null)  than lookup abc.csv name output name hostname ip if hostname=echo than lookup abc.csv name output name hostname ip Here is the catch, if 1st if condition is executed it should ignore 2nd & 3rd. if 2nd if statement executed than 3rd should ignored. Like wise i have to go upto 10 if condition.    

Hello, Is this still working with 4.0.2 version of the app ? I made the change, but unfortunately, nothing happens. How do you trigger the deletion? Restart Splunk? Unfortunately, I can no longer make any backups because I get an error saying that I have reached the size limit for backups. Thanks for your help.

Have you tried opening the searches from the dashboard in a search window? Try building up the search line by line until you find where the data is no longer available. If it is not available from the start, try checking that you have the correct permissions to see the data.

Yes you can using the lookup eval command https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/ConditionalFunctions#lookup.28.26lt.3Blookup_table.26gt.3B.2C.26lt.3Bjson_object.26gt.3B.2C.26lt.3Bjson_array.26gt.3B.29 It has to come from a CSV, you cannot use KV store lookups  

Thank you @Richfez  and @tscroggins for your solutions! For my use case the one given by @tscroggins suits best though. If I understand correctly, in order to be able to display the data this way, it is a must that the data is ordered so that there is one record per workday with each event timestamp in it's own column. In your data example, the timestamps are each in a new column. So when we would have a 100 events in 7 days, it means 100 different columns. Is it doable to manipulate the data so that for each day, the timestamps are inserted starting at event01?  Below is an example of what the data looks like, followed by how I would like it to be. Any suggestions on how to achieve this?   For others reading along, I use dashboard studio and was able to replicate the visualization by adding this to the visualization code:  "overlayFields": "event01, event02, event03, event04, event05, event06, event07, event08, event09, event10, event11, event12"