Hi If you have some fields with and without the ., below is an example of how to get that to work. However it only works going into an event index, it does not seem to work going into metrices. [test_abc_transforms] CLEAN_KEYS = false DELIMS=, FIELDS=degraded.threshold,down.threshold [drop_header] REGEX = metric_timestamp,metric_name,_value,degraded\.threshold,down\.threshold DEST_KEY = queue FORMAT = nullQueue     metric_timestamp,metric_name,_value,degraded.threshold,down.threshold 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300 1695201472,mx.process.cpu.utilization,1.373348018,30,300  

Hello To find and fix CSV header errors in multiple files, write a script to check for duplicate column names and invalid fields in the header row. Then, run the script on your CSV file directory. For Python, a basic example might look like this:   import csv import os def check_csv_headers(file_path): with open(file_path, 'r') as csvfile: csvreader = csv.DictReader(csvfile) headers = csvreader.fieldnames if len(headers) != len(set(headers)): print(f"Duplicate columns in: {file_path}") if '' in headers: print(f"Invalid field name in: {file_path}") # Directory containing CSV files directory = '/path/to/csv/files' for filename in os.listdir(directory): if filename.endswith('.csv'): file_path = os.path.join(directory, filename) check_csv_headers(file_path) Save the script to a file, make it executable (if needed), and run it against your directory containing the CSV files. python check_csv_headers.py This approach automates the process of scanning your CSV files for errors and should help you efficiently locate and fix these issues across multiple files within your Splunk Heavy Forwarder. You can also check https://community.splunk.com/t5/Knowledge-Management/bd-p/knowledge-management/CCSP Certification Thank you

Here is one .conf presentation about using TERM and PREFIX https://conf.splunk.com/files/2021/slides/TRU1133B.pdf There are also couple of other which you should read to full understand what TERM actually means and how to use it.

Also, when I am trying to click "open in search" directly from lookup editor. it gives me prompt with below error: This lookup doesn't have a transforms.conf entry and needs one in order to be accessible in search.

So, you want trellis breakdown on SectionName, not on Attribute.  This says even more of the importance of illustrating data input and desired output.  Really all of this should be in text.  Anyway, I mocked up three SectionName values based off what you showed in both text and screenshots, and revised https://gist.github.com/whackyhack/af1d0b20e297a5237594cbb6aaacc0f6 to mock trellis by SectionName.   Needless to say: You need to know all possible values of SectionName in advance. (And if you want the tables to be in alphabetic order, you need to arrange all of them in that order manually.)  The token setting is based on a search where only two SectionName values are returned, namely HTTP Plugin settings and Transport chain: WCInboundDefaultSecure:Channel HTTP.  Therefore table for Process Definition is hidden. Core search to set token by SessionName should be simply     index = websphere_cct (Object= "HJn5server1" Env="Prod") OR (Object = "HJn7server3" Env="UAT") [ search index=websphere_cct SectionName=* | dedup Order | table Order ] | stats values(SectionName) as SectionName       Also note that token name cannot contain colon (:); for this reason, I used $Transport chain- WCInboundDefaultSecure-Channel HTTP$ as token name.  Again this mock trellis requires you to know all possible values of SectionName in advance, and manually program all <table/>  For you to more easily compare to real data, here is the data emulation code     | makeresults | eval data = mvappend("{\"ObjectType \":\"AppServer\",\"Object\":\"HJn7server3\",\"Order\":\"147\",\"Env\":\"UAT\",\"SectionName\":\"Transport chain: WCInboundDefaultSecure:Channel HTTP\", \"Attributes\":{\"discriminationWeight\": \"10\",\"enableLogging\": \"FALSE\",\"keepAlive\": \"TRUE\",\"maxFieldSize\": \"32768\",\"maxHeaders\": \"500\",\"maxRequestMessageBodySize\": \"-1\",\"maximumPersistentRequests\": \"100\",\"name\": \"HTTP_4\",\"persistentTimeout\": \"30\",\"readTimeout\": \"60\",\"useChannelAccessLoggingSettings\": \"FALSE\",\"useChannelErrorLoggingSettings\": \"FALSE\",\"useChannelFRCALoggingSettings\": \"FALSE\",\"writeTimeout\": \"60\"}}", "{\"ObjectType \":\"AppServer\",\"Object\":\"HJn5server1\",\"Order\":\"147\",\"Env\":\"UAT\",\"SectionName\":\"Transport chain: WCInboundDefaultSecure:Channel HTTP\", \"Attributes\":{\"discriminationWeight\": \"10\",\"enableLogging\": \"FALSE\",\"keepAlive\": \"TRUE\",\"maxFieldSize\": \"32768\",\"maxHeaders\": \"500\",\"maxRequestMessageBodySize\": \"-1\",\"maximumPersistentRequests\": \"100\",\"name\": \"HTTP_4\",\"persistentTimeout\": \"30\",\"readTimeout\": \"60\",\"useChannelAccessLoggingSettings\": \"FALSE\",\"useChannelErrorLoggingSettings\": \"FALSE\",\"useChannelFRCALoggingSettings\": \"FALSE\",\"writeTimeout\": \"60\"}}", "{\"ObjectType \":\"AppServer\",\"Object\":\"HJn7server3\",\"Order\":\"147\",\"Env\":\"PROD\",\"SectionName\":\"Process Definition\", \"Attributes\":{\"IBM_HEAPDUMP_OUTOFMEMORY\": \"\",\"executableArguments\": \"[]\",\"executableTarget\": \"com.ibm.ws.runtime.WsServer\",\"executableTargetKind\": \"JAVA_CLASS\",\"startCommandArgs\": \"[]\",\"stopCommandArgs\": \"[]\",\"terminateCommandArgs\": \"[]\",\"workingDirectory\": \"${USER_INSTALL_ROOT}\"}}", "{\"ObjectType \":\"AppServer\",\"Object\":\"HJn5server1\",\"Order\":\"147\",\"Env\":\"UAT\",\"SectionName\":\"Process Definition\", \"Attributes\":{\"IBM_HEAPDUMP_OUTOFMEMORY\": \"\",\"executableArguments\": \"[]\",\"executableTarget\": \"com.ibm.ws.runtime.WsServer\",\"executableTargetKind\": \"JAVA_CLASS\",\"startCommandArgs\": \"[]\",\"stopCommandArgs\": \"[]\",\"terminateCommandArgs\": \"[]\",\"workingDirectory\": \"${USER_INSTALL_ROOT}\"}}", "{\"ObjectType \":\"AppServer\",\"Object\":\"HJn7server3\",\"Order\":\"147\",\"Env\":\"PROD\",\"SectionName\":\"HTTP Plugin settings\", \"Attributes\":{\"ConnectTimeout\": 5,\"MaxConnections\": -1,\"Role\": \"PRIMARY\",\"ExtendedHandshake\": false,\"ServerIOTimeout\": 900,\"waitForContinue\": false}}", "{\"ObjectType \":\"AppServer\",\"Object\":\"HJn5server1\",\"Order\":\"147\",\"Env\":\"PROD\",\"SectionName\":\"HTTP Plugin settings\", \"Attributes\":{\"ConnectTimeout\": 5,\"MaxConnections\": -1,\"Role\": \"PRIMARY\",\"ExtendedHandshake\": false,\"ServerIOTimeout\": 900,\"waitForContinue\": false}}") | mvexpand data | rename data as _raw ``` above emulates index = websphere_cct (Object= "HJn5server1" Env="Prod") OR (Object = "HJn7server3" Env="UAT") [ search index=websphere_cct SectionName=* | dedup Order | table Order ] ```     or _raw {"ObjectType ":"AppServer","Object":"HJn7server3","Order":"147","Env":"UAT","SectionName":"Transport chain: WCInboundDefaultSecure:Channel HTTP", "Attributes":{"discriminationWeight": "10","enableLogging": "FALSE","keepAlive": "TRUE","maxFieldSize": "32768","maxHeaders": "500","maxRequestMessageBodySize": "-1","maximumPersistentRequests": "100","name": "HTTP_4","persistentTimeout": "30","readTimeout": "60","useChannelAccessLoggingSettings": "FALSE","useChannelErrorLoggingSettings": "FALSE","useChannelFRCALoggingSettings": "FALSE","writeTimeout": "60"}} {"ObjectType ":"AppServer","Object":"HJn5server1","Order":"147","Env":"UAT","SectionName":"Transport chain: WCInboundDefaultSecure:Channel HTTP", "Attributes":{"discriminationWeight": "10","enableLogging": "FALSE","keepAlive": "TRUE","maxFieldSize": "32768","maxHeaders": "500","maxRequestMessageBodySize": "-1","maximumPersistentRequests": "100","name": "HTTP_4","persistentTimeout": "30","readTimeout": "60","useChannelAccessLoggingSettings": "FALSE","useChannelErrorLoggingSettings": "FALSE","useChannelFRCALoggingSettings": "FALSE","writeTimeout": "60"}} {"ObjectType ":"AppServer","Object":"HJn7server3","Order":"147","Env":"PROD","SectionName":"Process Definition", "Attributes":{"IBM_HEAPDUMP_OUTOFMEMORY": "","executableArguments": "[]","executableTarget": "com.ibm.ws.runtime.WsServer","executableTargetKind": "JAVA_CLASS","startCommandArgs": "[]","stopCommandArgs": "[]","terminateCommandArgs": "[]","workingDirectory": "${USER_INSTALL_ROOT}"}} {"ObjectType ":"AppServer","Object":"HJn5server1","Order":"147","Env":"UAT","SectionName":"Process Definition", "Attributes":{"IBM_HEAPDUMP_OUTOFMEMORY": "","executableArguments": "[]","executableTarget": "com.ibm.ws.runtime.WsServer","executableTargetKind": "JAVA_CLASS","startCommandArgs": "[]","stopCommandArgs": "[]","terminateCommandArgs": "[]","workingDirectory": "${USER_INSTALL_ROOT}"}} {"ObjectType ":"AppServer","Object":"HJn7server3","Order":"147","Env":"PROD","SectionName":"HTTP Plugin settings", "Attributes":{"ConnectTimeout": 5,"MaxConnections": -1,"Role": "PRIMARY","ExtendedHandshake": false,"ServerIOTimeout": 900,"waitForContinue": false}} {"ObjectType ":"AppServer","Object":"HJn5server1","Order":"147","Env":"PROD","SectionName":"HTTP Plugin settings", "Attributes":{"ConnectTimeout": 5,"MaxConnections": -1,"Role": "PRIMARY","ExtendedHandshake": false,"ServerIOTimeout": 900,"waitForContinue": false}}

Hi @Madhusmita, you can attach to an email only one csv, not more, so, the only way (when possible) is to append the results of several searches, but readablity could be very low if they are diferent. I hint to create more alerts, one for each csv. Ciao. Giuseppe