I tried below search for 2nd question but didn't work. P.S: In my environment we parsed EventID as EventCode | rest /services/saved/searches | search is_scheduled=1 OR alert_type=1 | table title, actions | mvexpand actions | rex field=actions ".*EventCode=(?<EventCode>\d+).*" | stats count by EventCode, title   Please help me..

Hi @splunk_learn, good for you, see next time! let me know if I can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated

Your logs look like compliant XML.  I am guessing that you already have the field "Message Text".  If so, you can apply @bowesmana's technique   | eval SequenceNumber = mvindex(split('Message Text', " : "), 1) | eval SequenceNumber = split(SequenceNumber, ",") | mvexpand SequenceNumber   (Replace 'Message Text' with MessageText if that's the field name.)  Your sample logs should give you something like SequenceNumber _time 00000000000000875119 2023-08-30 21:45:02.212 00000000000000875120 2023-08-30 21:45:02.212 00000000000000875121 2023-08-30 21:45:02.212 00000000000000875122 2023-08-30 21:45:02.212 00000000000000875123 2023-08-30 21:45:02.212 00000000000000875124 2023-08-30 21:45:02.212 00000000000000875115 2023-08-30 20:45:02.083 00000000000000875116 2023-08-30 20:45:02.083 00000000000000875117 2023-08-30 20:45:02.083 00000000000000875118 2023-08-30 20:45:02.083 00000000000000875114 2023-08-30 19:45:01.909 00000000000000875112 2023-08-30 18:45:02.703 00000000000000875113 2023-08-30 18:45:02.703 Here is an emulation that you can play with and compare with real data   | makeresults | eval data = split("<Create Timestamp>2023-08-31T04:45:02.212Z</Create Timestamp> <Message Text>Sequence Numbers processed during this transaction : 00000000000000875119,00000000000000875120,00000000000000875121,00000000000000875122,00000000000000875123,00000000000000875124</Message Text> <Create Timestamp>2023-08-31T03:45:02.083Z</Create Timestamp> <Message Text>Sequence Numbers processed during this transaction : 00000000000000875115,00000000000000875116,00000000000000875117,00000000000000875118</Message Text> <Create Timestamp>2023-08-31T02:45:01.909Z</Create Timestamp> <Message Text>Sequence Numbers processed during this transaction : 00000000000000875114</Message Text> <Create Timestamp>2023-08-31T01:45:02.703Z</Create Timestamp> <Message Text>Sequence Numbers processed during this transaction : 00000000000000875112,00000000000000875113</Message Text>", " ") | mvexpand data | rename data as _raw | spath | rename "Create./Create.Message" AS "Message Text" | eval _time = strptime(Create, "%FT%H:%M:%S.%3Q%Z") | rename Create AS "Create Timestamp" ``` data emulation above ```  

If I understand the requirements correctly, an alert sequence is one in which task_id is equal but a later event_id is greater than an earlier one, you can say that conceptually, you need a temporary storage.  But like most languages, SPL commands RAM for such transient needs. From your sample log, is the following what you are looking for? event_name task_id _time event_id server_state 0 2023-08-01 15:41:40.395,2023-08-01 15:10:40.395 1545468 1545467 server_state 1 2023-08-01 15:45:40.395,2023-08-01 15:15:40.395 1135465 1135464 server_state 2 2023-08-01 15:50:40.395,2023-08-01 15:25:40.395 1201257 1201256 server_state 3 2023-08-01 15:52:40.395,2023-08-01 15:36:40.395 1223681 1223680 You can achieve this with the following assuming that event_name, task_id, and event_id are already extracted:   | stats list(_time) as _time list(event_id) as event_id by event_name task_id | where mvindex(_time, 0) > mvindex(_time, -1) AND mvindex(event_id, 0) > mvindex(event_id, -1) OR mvindex(_time, 0) < mvindex(_time, -1) AND mvindex(event_id, 0) < mvindex(event_id, -1) | fieldformat _time = strftime(_time, "%F %H:%M:%S.%3Q")   Here is an emulation of your sample data that you can play with and compare with real data.   | makeresults | eval data = split("8/01/2023 3:52:40.395 PM server_state|3 1223681 5 8/01/2023 3:50:40.395 PM server_state|2 1201257 3 8/01/2023 3:45:40.395 PM server_state|1 1135465 2 8/01/2023 3:41:40.395 PM server_state|0 1545468 5 8/01/2023 3:36:40.395 PM server_state|3 1223680 0 8/01/2023 3:25:40.395 PM server_state|2 1201256 2 8/01/2023 3:15:40.395 PM server_state|1 1135464 3 8/01/2023 3:10:40.395 PM server_state|0 1545467 8", " ") | mvexpand data | rename data as _raw | rex "(?<ts>(\S+\s){3}) (?<event_name>\w+)\|(?<task_id>\d+) (?<event_id>\d+)" | eval _time = strptime(ts, "%m/%d/%Y %I:%M:%S.%3Q %p") ``` data emulation above ```    Hope this helps.

<form version="1.1"> <label>Multiselect</label> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="packetsize" searchWhenChanged="true"> <label>Packet Size</label> <search> <query> ``` Query to generate packet sizes dynamially ``` | makeresults | eval packetsize=split("40,128,520",",") | mvexpand packetsize </query> </search> <fieldForValue>packetsize</fieldForValue> <fieldForLabel>packetsize</fieldForLabel> <delimiter>,</delimiter> <change> <eval token="firstpacketsize">mvindex('form.packetsize',0)</eval> <eval token="secondpacketsize">mvindex('form.packetsize',1)</eval> <eval token="thirdpacketsize">mvindex('form.packetsize',2)</eval> <eval token="fourthpacketsize">mvindex('form.packetsize',3)</eval> <eval token="fifthpacketsize">mvindex('form.packetsize',4)</eval> </change> </input> </fieldset> <row> <panel depends="$firstpacketsize$"> <title>Packet size = $firstpacketsize$</title> <table> <search> <query> ``` Query to generate results based on packet size ``` | makeresults | eval packetsize="$firstpacketsize$" </query> </search> <option name="drilldown">cell</option> </table> </panel> <panel depends="$secondpacketsize$"> <title>Packet size = $secondpacketsize$</title> <table> <search> <query> ``` Query to generate results based on packet size ``` | makeresults | eval packetsize="$secondpacketsize$" </query> </search> </table> </panel> <panel depends="$thirdpacketsize$"> <title>Packet size = $thirdpacketsize$</title> <table> <search> <query> ``` Query to generate results based on packet size ``` | makeresults | eval packetsize="$thirdpacketsize$" </query> </search> </table> </panel> <panel depends="$fourthpacketsize$"> <title>Packet size = $fourthpacketsize$</title> <table> <search> <query> ``` Query to generate results based on packet size ``` | makeresults | eval packetsize="$fourthpacketsize$" </query> </search> </table> </panel> <panel depends="$fifthpacketsize$"> <title>Packet size = $fifthpacketsize$</title> <table> <search> <query> ``` Query to generate results based on packet size ``` | makeresults | eval packetsize="$fifthpacketsize$" </query> </search> </table> </panel> </row> </form>

SAMPLE LOGS: <Create Timestamp>2023-08-31T04:45:02.212Z</Create Timestamp> <Message Text>Sequence Numbers processed during this transaction : 00000000000000875119,00000000000000875120,00000000000000875121,00000000000000875122,00000000000000875123,00000000000000875124</Message Text> <Create Timestamp>2023-08-31T03:45:02.083Z</Create Timestamp> <Message Text>Sequence Numbers processed during this transaction : 00000000000000875115,00000000000000875116,00000000000000875117,00000000000000875118</Message Text>   <Create Timestamp>2023-08-31T02:45:01.909Z</Create Timestamp> <Message Text>Sequence Numbers processed during this transaction : 00000000000000875114</Message Text>   <Create Timestamp>2023-08-31T01:45:02.703Z</Create Timestamp> <Message Text>Sequence Numbers processed during this transaction : 00000000000000875112,00000000000000875113</Message Text>

Hi @gcusello  & @bowesmana ,   Thanks for the prompt responses.   You both gave answers for static set of numbers. What if this set of field values are dynamically changing and combined with string as well. In that case,How Can I separate this dynamic set of numbers from string and display them individually instead of comma separated in table format. We crossed half of the solution,You already responded to split comma separated values and display them in table format. I need to solution for below two case: 1. What if this set of numbers are dynamically logging into splunk using one fields(MessageText)? 2. These dynamic set of numbers combined with text like(Sequence Numbers processed during this transaction in the field (MessageText).How can I separate only numbers and display them in above mentioned format like: 00000000000000872510 00000000000000872511 00000000000000872512 00000000000000872513 00000000000000872514   instead of 00000000000000872510,00000000000000872511,00000000000000872512,00000000000000872513,00000000000000872514 (these set of numbers are not static keeps on changing for each transaction and logging into splunk as individual event in (message text) field.)