Hi jdaves, Okay maybe this is not exactly the same use case....but I use a lookup file that looks like this: host,number,processlist hostA,3,process1 process2 process3 hostB,2,process1 process2 This is used as auto lookup and provides for each matching host an multivalue field called must_run . I use this field to compare running processes against the must_run processes (using the Splunk ps.sh) like this: base search here | multikv fields COMMAND filter myProc | stats values(COMMAND) as myProc_running values(must_run) AS must_run by host _time | makemv must_run | mvexpand must_run | where must_run!=myProc_running | do more Splunk-Fu here .... This works perfectly. Regarding your QID : is this mutlivalued in the lookup or in the search? if it is in the search, you could use makemv/mvexpand before the lookup. hope this helps ... cheers, MuS ... View more

Hi mvaradarajam, try something like this: your base search here date_hour>13 AND date_hour<17 | timechart span=1d count by date_wday hope this helps ... cheers, MuS ... View more

Hi abhayneilam, based on the provided information, which is by the way very little, try something like this: index="AAA" OR index="BBB" | rex "XXXXXX\]\[(?<myID>.*?)\]" | rex "CCCCCCC\]\[(?<myID>.*?)\]" | streamstats window=2 last(myID) AS last_myID | where myID=last_myID | stats count by myID This should give you an idea or take a closer look at this answer http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html hope this helps ... cheers, MuS ... View more