Hi, I want to extract below fields First 5 fields are automatically extracted by splunk witihout any issues. But last 2 fields since they are starting with # symbol didnt get extracted correctly. How can i extract them ? EmpNo,EmpName,EmpTitle,Region,Country,# completed,#not completed 12345,"Razal,Rafi",Lead Service Specialist,UK,United Kingdom,0,1 My file contnt looks like above line. I surrounded them with double quotes thinking that it will be easy for extraction since i have comma in Name field along with comma as delimiter to look like below. "12345",""Razal,Rafi"","Lead Service Specialist","UK","United Kingdom","0","1" Please help me with rex for field extraction. to extract last two fields. ... View more

Hi, I have a csv file which i am indexing first and then generating the output.csv file using savedsearches.conf file. The data is coming properly but there is a problem with headers. The outputlookup file which is getting generated is converting all the forward slashes and hyphen symbols in the header to underscore. For ex: column header at source csv file - "First/Last Name","Designation","Skill - Level" getting converted to destination csv file - "First_Last Name","Designation","Skill_Level" How do get the headers as it is in the output lookup file ? ... View more

I have a field called Manager Name which come is some files managerforename,managersurname and in some managersurname,managerforename. Now i have another lookup file which has two columns manager fullname and manager surname. I am doing a concat to update the dropdown with the names of manager like managerforename,managersurname Now using that token to search and update the tables below to show data for only that manager. Everything works fine except certain scenarios where the name doesn have an exact match. Example : From dropdown am getting Mark,Spencer to get a match from another file which has manager name like this: Mark Chalal,Spencer Hodd So what i want is i just want to get a match if that name is contained in the other file. |inputlookup employeemanager.csv| search "department name"="$deptname$" |eval "Manager Fullname"='Manager Forename' + "," + 'Manager Surname'| dedup "Manager Fullname"| table "Manager Fullname" This is the code for the dropdown to get updated with corresponding departments manager names. So i get the manager name in the token say managername Next i am using the token managername in my panel query |inputlookup PerformanceData.csv |search "department name"="$deptname$" "Performance Manager"="$managername$"| stats count as bla bla.... How to do this. ... View more

Current output is attached in the image. i have one input lookup file file1.csv 1) Rows 2-4 are coming are coming from column "ITO Department" of lookup file 2) Rows 6 till 8 are coming from "Other Department" of the same lookup file. 3) ALL ITO is sum of all ITO Department names 4) TOTAL is total of all ALL ITO + 6 to 8 Now how do i achieve this as when i am adding TOTAL using addtotals its giving me sum of all which leads to a count of 20 ... View more