The stats, eventstats, and streamstats expect field names rather than expressions.   To use an expression, embed the eval function. index=vs_email [email protected] | eval direction=case(RecipientAddress="[email protected]", "inbound", RecipientAddress!="[email protected]", "outbound") | dedup MessageId | bin _time span=1d | eventstats count(eval(direction="inbound")) as inbound_count | eventstats count(eval(direction="outbound")) as outbound_count | dedup _time | eventstats avg(inbound_count) as average_inbound_count | eventstats avg(outbound_count) as average_outbound_count | table inbound_count outbound_count average_inbound_count average_outbound_count ... View more

Use the same answer I gave earlier, except change the file name and output field name. BTW, lookup files typically don't contain timestamps. ... View more

That sounds like a job for the stats command.  For speed, use tstats. | tstats count where index=* host=* sourcetype="cisco:ios" by host   ... View more

Lookup always return the first match.  Edit the lookup to put the smaller subnets before the larger ones. ... View more

SPL does not support branching commands.  Branching is only supported within the eval, where, and fieldformat commands. To remove lines from a lookup table, use the where command to filter out unwanted result and write the remainder back to the lookup. | inputlookup append=true login_sessions.csv | where action!="login" | eval UID=userID, sessionstart=session_start, sessionend=session_end | outputlookup login_sessions.csv   ... View more