Hi, Can you please try using css !important feature? https://css-tricks.com/when-using-important-is-the-right-choice/ Thanks!!! ... View more

There is no conditional lookups concept in splunk. You can use SPL to achieve the same: index=A | lookup mylookup fieldin1 OUTPUT fieldout1 | lookup mylookup2 fieldin2 OUTPUT fieldOUT2 | lookup mylookup3 fieldin3 OUTPUT fieldout3 | eval MyField= coalesce(fieldout1, fieldOUT2) | fillnull value="NULL" fieldout3 | where fieldout3="NULL" Thanks!!! ... View more

Following are couple of options: Option 1 Change the query to return the different values of ip addresses. e.g. [| script myscript| stats values(ip) as ips | return $ips] Option 2 Use subsearch to compute the ip count (dynamically) and use it in the main search. e.g. [| script myscript| return [| script myscript | stats count(ip) as count | return $count] $ip] Thanks!! ... View more

Check the indentation in the code. If the code is not having the proper indentation, then the code will not compile. Use Python Editor (Python IDE) for editing the python files. Using notepad/textpad will not give you proper indentation. ... View more

HI, The solution will be much simpler if you can get the access to raw logs. In case, its not possible, you can try following approach. | inputlookup Data.csv | eval customField=[| inputlookup Data.csv | table time,busycore,cpu0,cpu1,cpu2 | fields - time busycore | transpose | fields column| eval customField = "\"".column."=\".".column.".\"~\"." | stats values(customField) as QueryValues | makemv delim="||" QueryValues | eval QueryFilter = substr(QueryValues , 1, len(QueryValues)-5) | return $QueryFilter] | makemv delim="~" customField | fields time busycore customField | mvexpand customField | eval customField = split(customField ,"=") | eval cpuName = mvindex(customField, 0) | eval cpuUsage=mvindex(customField, 1) | eventstats max(cpuUsage) as maxUsageByTime by time | eval maxCheck=if(cpuUsage==maxUsageByTime,"Yes","NO") Here is an explanation: Load the data : *| inputlookup Data.csv * Dynamically construct a customField which will have value like "cpu0=".cpu0."~". "cpu1=".cpu1."~". "cpu2=".cpu2. This value will change depending on the number of CPU information you have in the data. The subsearch dynamically construct the string similar to above string. Rearrange the data as multiple events so that stats function can be used. All the events with maxCheck=Yes are the maximum value for that time. Thanks!! ... View more