Thanks for that. I understand the logic behind this now, but the search returns nothing so far. When you say that you have a SendmailMessageID created via a rex command, do you need to create this again in the outer search? As to my mind this is the 'variable' to put it that we want to use in the outer search. it seems to me that we are just defining it again, instead of passing the value of it from the inner search to the outer search. The inner search on its own will return over 1000 unique values, which I then want to use to do an additional search for each. index=linux_syslog netgroup=my_servers* "succesfull delivery" [search index=linux_syslog netgroup=my_servers* [email protected]| rex field=_raw "sendmail\[\d+\]: (?<SendmailMessageID>\w+):" | stats count by SendmailMessageID] | rex field=_raw "sendmail\[\d+\]: (?<SendmailMessageID>\w+):" As an aside what is authenticationtype used for? ... View more

Thanks for that. My full query is the following. index=linux_syslog netgroup=sap* process="sshd" "session opened for user" | rex field=_raw "session opened for user (?<user>.*) by" | lookup groupLookup user OUTPUTNEW gid posixgroup given sn | convert timeformat="%d/%m/%y" ctime(_time) as login_time | search posixgroup="groupname" | chart values(posixgroup), values(given), values(sn), latest(login_time) by user | rename user AS "User" | rename values(posixgroup) AS "Groups" | rename values(given) AS "Given Name" | rename values(sn) AS Surname | rename latest(login_time) AS "Last Login" I think the reason this is not working is because the firstname (given) and the surname (sn) are being generated only by the lookup, not take from the actual log itself, therefore it fails. Now unless there is some nifty way I can do this the only other way to get around this is to just export the data into the lookup lookup groupLookup user OUTPUTNEW gid posixgroup given sn fullname ... View more

Thanks for the tip. Unfortunately, using latest() instead of values() does not produce anything either. ... View more