example  | where id != id_old or not match(username) is it possible to write something similar @ITWhisperer  ... View more

@ITWhisperer  I have a check where two parameters are compared via "where" example | where id != id_old there are already users with ID in the file, and after verification new IDs are added. But it happens that a new user appears in the index.  And it turns out if "| where id != id_old" it does not pass.  And I need to add a condition,if the check did not work "| where id != id_old", then check whether such a user exists at all in the file ... View more

@ITWhisperer  can it be done through "where"? ... View more

index = index | table username src_ip asn | lookup username user.csv OUTPUT asn_old | where asn != asn_old ... View more

Error in 'lookup' command: Could not construct lookup 'username, file.csv, OUTPUT, id_old'. ... View more

@nmohammed  No no no no.  if the first three src_ip values match the IP address. then takes on these values if src_ip(192.168.16.35) = IP address(192.168.16.0/24)   ... View more

@richgalloway  how to check the storage system?) Thanks  ... View more

@richgalloway. Hello ! Thanks for answering.  SH shows how much data is total and after the master has been turned off and on. I saw that the data was missing 2 times. I got a message now Search peer SH has the following message: Now skipping indexing of internal audit events, because the downstream queue is not accepting data. Will keep dropping events until data flow resumes. Review system health: ensure downstream indexing and/or forwarding are operating correctly.   the problem arose after switching off and on the MN ... View more

@PickleRick OK. I heard you. but you can somehow pass the created variable "email". to the "to" part of the "sendemail" command? without sending the result? something like this | sendemail to=$email$ message="Test messages to users". ? It does not see "$email$" in this format ... View more

@PickleRick Yes. I'm sure the names are the same as the email address. how to write an application correctly. write please? I tried to write "| eval email = $username$."@gmail.com"" the address comes out almost, but the command "| sendemail to = $email$" does not accept for some reason ... View more

@ITWhisperer You are the best!! Thanks  ... View more

@ITWhisperer Thanks my friend. but can you tell me how to correctly pull data from files using inputlookup? Thanks a lot !! ... View more

@ITWhisperer  But how to make the check on two attributes. but how to do a check on two attributes. if both are not alike when I write a check for two attributes using "or". that is, one thing is similar, nothing comes out of my output. And if both are not alike, then everything turns out right If  file1.csv user id_user group John 123 56   file2.csv  user id_user group John 124 56   | inputlookup file1.csv | rename id_user as id_user1 | rename group as group1 | append [| inputlookup file2.csv] | stats values(id_user1) as id_user1 values(id_user) as id_user2 values(group1) as group1 values(group) as group2 by username | where id_user1 != id_user2 or group1 != group2  output: user  id_user1  id_user2 group1 group2 John 123 124 56 56   but need: user id_user1 id_user2 group John 123 124 56 ... View more