You need to mind the basics of posing an answerable question: clearly illustrate data input (in text table), illustrate desired output (also in text unless it is a graphic visualization), and explain the logic in clear language.   It is really unclear what is the relationship between these field values.   If I have to speculate, Appname, and requestor are always paired, S.No and host are always paired.  Is this correct?  Based on this, I made up the following mock data: Appname S.No host logtype requestor source A 1 ghi somelog abc@def.com somelog.jkl A 1 ghi somelog abc@def.com somelog.klm A 1 ghi somelog abc@def.com somelog.lmn B 2 hij somelog bcd@efg.com somelog.klm B 2 hij somelog bcd@efg.com somelog.jkl C 3 ijk somelog cde@fgh.com somelog.lmn C 3 ijk somelog cde@fgh.com somelog.aaa A 4 xyz somelog abc@def.com somelog.opq A 4 xyz somelog abc@def.com somelog.opq A 4 xyz somelog abc@def.com somelog.bbb B 5 wxy somelog bcd@efg.com somelog.rst B 5 wxy somelog bcd@efg.com somelog.uvw C 6 vwx somelog cde@fgh.com somelog.uvw C 6 vwx somelog cde@fgh.com somelog.rst C 6 vwx somelog cde@fgh.com somelog.opq A 7 aaa somelog abc@def.com somelog.klm A 7 aaa somelog abc@def.com somelog.lmn A 7 aaa somelog abc@def.com somelog.jkl B 8 bbb somelog bcd@efg.com somelog.klm C 9 ccc somelog cde@fgh.com somelog.lmn C 9 ccc somelog cde@fgh.com somelog.aaa C 9 ccc somelog cde@fgh.com somelog.bbb A 10 hij somelog abc@def.com somelog.aaa B 11 jkl somelog bcd@efg.com somelog.aaa B 11 jkl somelog bcd@efg.com somelog.bbb B 11 jkl somelog bcd@efg.com somelog.ccc C 12 ijk somelog cde@fgh.com somelog.abc C 12 ijk somelog cde@fgh.com somelog.ccc As @ITWhisperer says, Splunk is not a spreadsheet.  You cannot have cell merge and such.  But if you really want to simulate the effect, you can do something like this:     | stats values(source) as source by Appname logtype requestor S.No host | rename S.No as S_No | eval source = mvjoin(source, ", ") | tojson S_No host source | stats values(_raw) as _raw by Appname requestor logtype | eval host = mvmap(_raw, spath(_raw, "host")) | eval S.No = mvmap(_raw, spath(_raw, "S_No")) | eval source = mvmap(_raw, spath(_raw, "source")) | table S.No Appname requestor logtype source     Result from the above mock data is S.No Appname requestor logtype source 1 10 4 7 A abc@def.com somelog somelog.jkl, somelog.klm, somelog.lmn somelog.aaa somelog.bbb, somelog.opq somelog.jkl, somelog.klm, somelog.lmn 11 2 5 8 B bcd@efg.com somelog somelog.aaa, somelog.bbb, somelog.ccc somelog.jkl, somelog.klm somelog.rst, somelog.uvw somelog.klm 12 3 6 9 C cde@fgh.com somelog somelog.abc, somelog.ccc somelog.aaa, somelog.lmn somelog.opq, somelog.rst, somelog.uvw somelog.aaa, somelog.bbb, somelog.lmn Is this something you are looking for? Here is mock data emulation:     | makeresults format=csv data="S.No, requestor, Appname, host, logtype, source 1, abc@def.com, A, ghi, somelog, somelog.jkl 1, abc@def.com, A, ghi, somelog, somelog.klm 1, abc@def.com, A, ghi, somelog, somelog.lmn 2, bcd@efg.com, B, hij, somelog, somelog.klm 2, bcd@efg.com, B, hij, somelog, somelog.jkl 3, cde@fgh.com, C, ijk, somelog, somelog.lmn 3, cde@fgh.com, C, ijk, somelog, somelog.aaa 4, abc@def.com, A, xyz, somelog, somelog.opq 4, abc@def.com, A, xyz, somelog, somelog.opq 4, abc@def.com, A, xyz, somelog, somelog.bbb 5, bcd@efg.com, B, wxy, somelog, somelog.rst 5, bcd@efg.com, B, wxy, somelog, somelog.uvw 6, cde@fgh.com, C, vwx, somelog, somelog.uvw 6, cde@fgh.com, C, vwx, somelog, somelog.rst 6, cde@fgh.com, C, vwx, somelog, somelog.opq 7, abc@def.com, A, aaa, somelog, somelog.klm 7, abc@def.com, A, aaa, somelog, somelog.lmn 7, abc@def.com, A, aaa, somelog, somelog.jkl 8, bcd@efg.com, B, bbb, somelog, somelog.klm 9, cde@fgh.com, C, ccc, somelog, somelog.lmn 9, cde@fgh.com, C, ccc, somelog, somelog.aaa 9, cde@fgh.com, C, ccc, somelog, somelog.bbb 10, abc@def.com, A, hij, somelog, somelog.aaa 11, bcd@efg.com, B, jkl, somelog, somelog.aaa 11, bcd@efg.com, B, jkl, somelog, somelog.bbb 11, bcd@efg.com, B, jkl, somelog, somelog.ccc 12, cde@fgh.com, C, ijk, somelog, somelog.abc 12, cde@fgh.com, C, ijk, somelog, somelog.ccc" ``` data emulation above ```   ... View more

Like @ITWhisperer said, this is not JSON.  AND a strange choice of data format.  How to extract what you need depends quite on string values of "field1" "field2", "value1", "value2", etc.  If none of "fieldN", "valueN" contains hard breakers such as white space, you do something as simple as   | rex mode=sed field=params "s/: */=/g" | rename _raw as temp, params AS _raw | kv | rename temp AS _raw   (I assume that you already have the field params.) If the data is more complex than that, you will need to reconstruct data.  One way is to convert the structure into conformant JSON.  For example,   | rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/" | spath input=params   Here is a complete emulation   | makeresults | fields - _* | eval params = "['field1: value1', 'field2: value2', 'field3: value3']" | rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/" | spath input=params   field1 field2 field3 params value1 value2 value3 {"field1":"value1", "field2":"value2", "field3":"value3"} ... View more

If you already know the search ID, it shouldn't matter whether it is saved search or not. | rest /services/search/jobs/<search ID> | fields sid pid Here, pid is the process ID.  There are tons of other output from this call. If you only know the saved search's name, you can search by label | rest /services/search/jobs | where isSavedSearch == 1 AND label = "<your report name>" | fields label sid pid Hope this helps. ... View more

Your original idea of lookup should work.  Assuming your loadjob gives you a field named account_number, and that your lookup has a column account_number, you can do this   ``` search above gives account_number and other fields ``` | lookup mylookup account_number output account_number as match_account | where account_number == match_account   Is this something you are looking for? ... View more

Sorry I didn't realize the string of interest was in value. (There was a big discussion about field name recently.)  If so, regex is appropriate.  This should work   | eventstats values(name) as left_name | eval match_name = mvmap(left_name, mvappend(match_name, if(match(NAME, "^(.+_)*" . left_name . "_"), left_name, null()))) | eval joined = coalesce(name, match_name) | fields - *name NAME | stats values(*) as * by joined   Here I use joined instead of joined_name just to make field cleanup easier.  Here is some mock data: NAME left_data_var name right_data_var   leftbar1 RU3NDS     leftbar1 SOMETHING     leftbar2 ELSE   RU3NDS_abcd     rightbar1 RU3NDS_efgh     rightbar3 A_SOMETHING_abcd     rightbar2 SOMETHING_efgh     rightbar1 ELSE_bcde     rightbar2 A_RU3NDS_cdef     rightbar3 The result is joined left_data_var right_data_var ELSE leftbar2 rightbar2 RU3NDS leftbar1 rightbar1 rightbar3 SOMETHING leftbar1 rightbar1 rightbar2 It is really important to illustrate data and desired output when asking a data analytics question.  You could have saved everyone lots of time guessing. This is a full emulation   | makeresults format=csv data="name, left_data_var RU3NDS, leftbar1 SOMETHING, leftbar1 ELSE, leftbar2" | append [makeresults format=csv data="NAME, right_data_var RU3NDS_abcd, rightbar1 RU3NDS_efgh, rightbar3 A_SOMETHING_abcd, rightbar2 SOMETHING_efgh, rightbar1 ELSE_bcde, rightbar2 A_RU3NDS_cdef, rightbar3"] ``` data emulation above ``` | eventstats values(name) as left_name | eval match_name = mvmap(left_name, mvappend(match_name, if(match(NAME, "^(.+_)*" . left_name . "_"), left_name, null()))) | eval joined = coalesce(name, match_name) | fields - *name NAME | stats values(*) as * by joined     ... View more

Removing the dedup from your original suggestion seems to have cleared up the weird issue i was I should have noticed that dedup counters your goal. (I copied from your original illustration without considering implications in time interval.)  You are correct, this is one more reason you don't want to throw dedup around.  Is there an easy way to instead of  having a individual line for each "missing" pod, to either have a single line with the total count of "non-critical" pods and possibly also have two lines for "critical" and "non-critical"? First, let's clarify that your goal is to count the number of missing pod groups by importance.  Something like this should do: index=abc sourcetype=kubectl | lookup pod_list pod_name_lookup as pod_name OUTPUT pod_name_lookup | where sourcetype == "kubectl" | bin span=1h@h _time | stats values(pod_name_lookup) as pod_name_lookup values(pod_name_all) as pod_name_all by importance _time | append [ inputlookup pod_list | rename pod_name_lookup as pod_name_all] | eventstats values(pod_name_all) as pod_name_all importance | eval missing = if(isnull(pod_name_all), pod_name_all, mvappend(missing, mvmap(pod_name_all, if(pod_name_all IN (pod_name_lookup), null(), pod_name_all)))) | where isnotnull(missing) | timechart span=1m@m dc(missing) by importance Here is an emulation. | makeresults format=csv data="_time, pod_name, importance 10,apache-12, critical 22,apache-2, critical 34,kakfa-8, critical 80,superapp-13, critical 88,someapp-6 160,grafana-backup-11 166,apache-4, critical 168,kafka-6, critical 566,apache-4, critical 568,kafka-6, critical 174,someapp-2 250,grafana-backup-6 374,anotherapp-10" | fillnull importance value=non-critical | eval _time = now() - _time | eval sourcetype = "kubectl" | eval pod_name_lookup = replace(pod_name, "\d+", "*") ``` the above emulates index=abc sourcetype=kubectl | lookup pod_list pod_name_lookup as pod_name OUTPUT pod_name_lookup | dedup pod_name ``` | where sourcetype == "kubectl" | bin span=1m@m _time | stats values(pod_name_lookup) as pod_name_lookup values(pod_name_all) as pod_name_all by importance _time | append [makeresults format=csv data="namespace, pod_name_lookup, importance ns1, kafka-*, critical ns1, apache-*, critical ns2, grafana-backup-*, non-critical ns2, someapp-*, non-critical" ``` subsearch thus far emulates | inputlookup pod_list ``` | rename pod_name_lookup as pod_name_all] | eventstats values(pod_name_all) as pod_name_all by importance | eval missing = if(isnull(pod_name_all), pod_name_all, mvappend(missing, mvmap(pod_name_all, if(pod_name_all IN (pod_name_lookup), null(), pod_name_all)))) | where isnotnull(missing) | timechart span=1m@m dc(missing) by importance   ... View more