Hi cuppma, basically you do the reverse version of the docs about Configure Splunk forwarding to use the default certificate. First make sure your indexer is receiving on a non-SSL Port, next you remove the SSL settings from your UF outputs.conf to something like this: [tcpout:group1] server=some IP:some Port Hope this helps to get you started ... cheers, MuS ... View more

Hi rsathish47, try something like this: YourBaseSearchHere | streamstats current=f last(CA) as last_CA by Mailbox | where CA!=last_CA | ... this assumes that you have a mailbox field extracted that represents MailboxA and/or MailboxZ hops the helps to get you started ... cheers, MuS ... View more

Hi himynamesdave, This is completly untested, but try something like this: YourBaseSearch | eval Code="" | eval Country="" | inputcsv YourCSVfile append=true | eval myCountry=if(match(Number, Code), Country, "no match") ... This is still untested 😉 UPDATE: now this is tested and it is working 😉 YourBaseSearchHere | inputcsv YourcsvHere append=t | stats values(Code) AS Code values(Country) AS Country values(Number) AS Number | mvexpand Code | eval Code=substr(Code,2) | eval CountryName=if(match(Number, Code), Country, "No match") | table Number Code CountryName What is happening here? First you search your events and append some information from the csv, pass the values of the three fields Number Code and Country to stats, expand the multivalued in Code and remove the + from the Code. At last check if the Code matches any number and return a table of Number, International dialing code and Country name. Hope this helps to get you started and thx @martin_mueller for pushing me in the right direction... Cheers, MuS ... View more