Hi @gcusello , I am getting zero results when running first 3 lines of the query alone   ... View more

Hi @gcusello - any suggestions as we still not able to crack it ... View more

Hi @gcusello  Please find below 2 results where lookup query still showing count as 0 though the process returning events while running for index query alone Events related search from index   process query using lookup that shows count=0 ... View more

Hi @gcusello , Query isn't working fine But still the results are returning from lookup, even though process is up and running fine ... View more

Hi @gcusello  But in the INDEX query we are able to the see process related events returning. And my doubt here is the process name is getting updated in the field called "Name" in the INDEX based query how it is able to check and match the name which is in the lookup ("Process") field? ... View more

Hi @gcusello                   To test the query, i created one sample lookup "Test1.csv" and added only 2 entries and when i run the query those 2 entries are getting displayed in the result.                   Where as it shouldn't get displayed in the results for this query as those 2 processes are sending events to the index Process gets updated in lookup table field called "Process" in Index process name gets updated in the field called "Name" when these 2 matches we shouldn't be seeing the results, but we are seeing results   ... View more

Hi @gcusello  Thanks for providing the query, i believe this query will show the results for all the process matching with lookup and index based process events. Can we modify this query a little bit and see where we can see if the process from the lookup isn't coming in the index based process? ... View more

Hi @gcusello  - Please find the snapshot where i am getting error using same lookup name in both the inputlookup ... View more

Hi @gcusello ,              From the query you provided, in the look where this inputlookup is mentioned, can you please let me know do we need to create an empty lookup with host, Process and count fields? where the values gets captured from index and the existing lookup windows_proscess?   | inputlookup your_Process_Lookup.csv   ... View more

it should return host and Process results if the values from the lookup isn't coming/occurring as events through index ... View more

Hi @gcusello                      I have these many fields in the lookup "windows_process" host Process ResolutionID Assignment_Team Escalation_Team Urgency autocloser CI Attribute                     Is there any way to pick the value of "host" and "Process" from the lookup and match with values of "host" and "Process" which comes from the index=windows sourcetype=process? ... View more

Hi @gcusello , I understand that your query is picking the values from one lookup and appending to another lookup but actually my requirement, Splunk should show events when the values of host and process matches from one specific LOOKUP table when it matches with values of host and process which comes from the index query it should give the value ... View more

Hi @gcusello    getting error while trying to execute it Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression. ... View more

Hi @gcusello - i am getting the process names that aren't in the lookup also, where as i am looking only when both process name in lookup and index is matching ... View more

Now i am able to get the numeric values alone when i use ltrim command, but the values after ClusterCPUUsed= keeps changing, is there any way to read all the values when we are using ltrim or any other command. Kindly help   | eval CPUUsed=tonumber(ltrim("ClusterCPUUsed=10145", "ClusterCPUUsed=")) ... View more

Hi @PickleRick - Those values are from same events, Looking to show only the numbers The numbers whichever coming after equal to symbol has to show for the field names ClusterCPUUsed                    --------------------> Field name ClusterCPUUsed=31684                    --------------------> Field values 31684                                        -------------------------> Expected output ClusterCPUHALimit                    --------------------> Field name ClusterCPUHALimit=383880                    --------------------> Field values 383880                                                         -------------------------> Expected output HARamGBLimit                    --------------------> Field name HARamGBLimit=589                    --------------------> Field values 589                                                            -------------------------> Expected output ClusterMemUsedGB                    --------------------> Field name ClusterMemUsedGB=201                    --------------------> Field values 201                                        -------------------------> Expected output ... View more

Hi @richgalloway  - Thanks for providing the assistance Actually i was looking for a query without index=audit as i don't have admin priviliges. ... View more

Hi @gcusello  - Found that issue lies with docker related servers where default date/time fields are missing from the docker side itself so we have reached out to outcold solutions ... View more

Hi @gcusello - I tried those steps but still not working. I have attached the snapshot for reference. Initially with actual query Later without NOT and then also without date_wday=tuesday source=*cpu* cpu_load_percent>75 NOT (date_wday=tuesday AND date_hour>=0 AND (date_hour<3)) | stats latest(cpu_load_percent) as cpu_max_usage by _time, host | table _time host cpu_max_usage ... View more

Hi @gcusello  - The time period of my search is "Last 30 minutes", But for testing purpose to check the working of that "NOT" condition I modified to search "Today" as time range to look for results for that time returning or not. But the results are showing the stats value between the time 1 AM - 3 AM   NOT (date_wday=monday AND date_hour>=0 AND (date_hour<7)) ... View more