Hey Guys,  I am trying to write a SPL in splunk where I have a lookup file with 10 values and I want to search each value against a search and return results if found   Eg: LookupFile : Column name is States and the values are as below: Alaska Arizona Arkansas California Colorado Now I want to search each of the states one after the other in a search and display the results with the column (States, IP, Country, user, workstation) . Pls help.   Thank you   

Given the sample event below representing a user sign-in, I am trying to create a table that shows each combination of a 'policy' and 'result' and the number of occurrences for that combination. There are only three possible result values for any given policy (success, failure, or notApplied). In essence, I need this table to find out how which policies are not being used by looking at the number of times it was not applied. i.e.: Input:   Desired Output: displayName result count Policy1 success 1 Policy2 failure 1 Policy3 notApplied 1   However, the query I currently have is returning a sum that isn't possible because the sum is exceeding the number of sign-in events. What is wrong with my query? <my_search> | stats count by Policies{}.displayName, ConditionalAccessPolicies{}.result  

Hello all, is there a way to automate playbook to work only on events with specific tag? I saw in playbook settings an option to choose tag but it stills run on every event thank you in advance  @phanTom  @SOARt_of_Lost 

While it's possible to change the color of a single value icon based on a result, is it possible display an entirely different icon for different results or ranges? Not readily seeing an option in the Dashboard Studio. https://docs.splunk.com/Documentation/Splunk/9.0.2/DashStudio/chartsSV#Single_value_icon

Hi guys, So heres  what im trying to do. I have a lookup csv with 3 columns. I have data with string values that might contain a value in my lookup. I have the basic setup working but i want to populate additional fields in my data set. Here is a very stripped down version of what i am doing.  First I have a basic lookup csv. It has  3 columns: active flagtype colorkey yes sticker blue yes tape red no tape pink then my search which creates a couple test records looks like this: | makeresults count=4 | streamstats count | eval number = case(count=1, 25, count=2, 39, count=3, 31, count=4, null()) | eval string1 = case(count=1, "I like blue berries", count=3, "The sea is blue", count=2, "black is all colors", count=4, "Theredsunisredhot") | table flagtype, flag, string1, ck |search [ inputlookup templookup.csv | eval string1 = "string1=" + "\"" + "*" + colorkey + "*" + "\"" | return 500 $string1 ] | eval flag = "KEYWORD FLAG" | table flagtype, flag, string1, colorkey my 4 column output results are: flagtype flag string1 colorkey empty   KEYWORD FLAG   I like blue berries     empty empty   KEYWORD FLAG   The sea is blue          empty empty   KEYWORD FLAG   Theredsunisredhot empty How do  I populate the two empty columns using other columns in the lookup table. Thanks in advance for any help I can get.