The lookup command is doing precisely what it's told to do. The stuff before OUTPUT is which fields you want to use as input to your lookup and the stuff after OUTPUT is which fields should be output. In your case the lookup will read the value of the field "AET" in your event, try to match it to its "AET" values and if it finds a match, it will write the matching value in the "Location" field in your event. If you want to output to another field you can do it like this: ... | lookup AETtolocation AET OUTPUT Location AS AET More info in the docs: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup ... View more

... | eval diff=end_time-start_time ? ... View more

You can use subsearches to achieve this. It's a bit ugly but does the job. We're going to be using that subsearches treat the fields "query" and "search" differently than other field names in the way that the field names aren't used in the output. So [... | eval foo="bar" | fields foo] would return something like ((foo="bar")) whereas [... | eval query="bar" | fields query] would return (("bar")) We can't use this output right away in your scenario though because of the parantheses. Thankfully you can change the format that's used by the subsearch when returning results, by invoking the command format with the proper parameters at the end. In this case we just want to remove all parantheses so we just set empty strings for everything: [... | eval query="bar" | fields query | format "" "" "" "" "" ""] This will return "bar" We can now use this in your regex case. (The stats count at the beginning of the subsearch is just a dummy search, it's just there to be able to run the eval ) ... | rex field=_raw [|stats count | eval query=", ".$arg1$."=(?<bar>[^,]*)" | fields query | format "" "" "" "" "" ""] ... View more

Sadly, no. 😞 ... View more