@bowesmana , nope.. let me share the exact example values field a = AAAAA\ABCDE-SS410009$ field b = A=AAAAA\ABCDE-SS410009,B=Domain,C=AB,D=XXX,E=NET Now I want to match  field a= AAAAA\ABCDE-SS410009 field b= AAAAA\ABCDE-SS410009 like this

Hi @gcusello Thank You for the advice. I've already tried something similar, but I always get the error: "Error in 'EvalCommand': Failed to parse the provided arguments. Usage: eval dest_key = expression. "  Maybe I'm creating a new column wrong? I go to Add New -> Eval Expression, then Field name "OS" and expression - search text  

Assuming you have this data in Splunk and the field names are A_ X Y Z W, this examples shows how using your data, which you can copy/paste into a search | makeresults | eval _raw="A X Y Z W A8 2 B12 7 5 C14 5 D24 2 3" | multikv forceheader=1 | table A_ X Y Z W ``` Above reproduces your table ``` ``` Get the multiplier from the first field ``` | rex field=A_ "[A-Z](?<mul>\d+)" ``` Now Multiuply the field value by the multiplier ``` | foreach X Y Z W [ eval <<FIELD>>=<<FIELD>>*mul ] | fields - mul ``` and create the column totals ``` | addcoltotals  I am assuming your final column total for col W is not correct, but should read 5 * 12?  

This statement | eval down=$down$ is not a search statement - it is just creating a field called down with the value held by the token $down$ Maybe you mean you want to search for an existing field called down that has a value of the token, i.ei | search down=$down$ or one of these two statements depending if your token value is numeric (first option) or string (second) | where down=$down$ OR | where down=$down|s$  

I assume you're referring to your splunk.com account.  I went through the same thing a few years ago.  You have to create a new account and ask the certification (certification@splunk.com) and education (education_amer@splunk.com) teams to transfer your records to the new account.

It’s just an example. I have like 60 rows of a different data set and I need to download csv for each row. just like here, one for each country.  I need a way to do all of these in one go.  USA.                   DC, NY                             4.8

There are lots of errors in that query if cut/pasted to a Splunk search, but if you are not getting FailurePercentage, that's because the statement | eval (FailurePercentage = Failure/Sucess)*100 is not a valid Splunk eval statement and Sucess is also spelt incorrectly compared to the calculation in your stats command Note that your approach to appendcols if not a good way to approach this problem and can be done more efficiently like this index=dl* ("Error_MongoDB") OR ("inserted Record") | eval Status=if(match(_raw, "Error_MongoDB"), "Failure", "Success") | timechart span=1d count as Total by Status | eval FailurePercentage = (Failure/Success)*100 | fillnull FailurePercentage so you don't need a subsearch and can do it in one timechart and the fillnull will take care if the value of Success is 0 Note that the eval Status line may be improved if you have a field that can indicate success/failure better than by matching _raw