Hi, I have some sample/fake data represented as a table. When I click a value under ip , a drill down action is supposed to be ran based on if one of the 3 specific fields has a 1 as its value. How do I reference the fields here? ip jim_pc sally_pc joe_pc 11.11.11.1 1 0 0 22.22.22.2 0 1 0 Here's the piece of my xml that seems to always stores null in the token: <drilldown> <eval token="first_valid_source">case(jim_pc == 1, "jimmy", sally_pc == 1, "sally", joe_pc == 1, "joseph")</eval> ... </drilldown> ... View more

Hi, I have a CSV ( current_assets.csv ) with fields device_name and ip (and tons of values for them). Here is an example: device_name ip router1 122.145.11.2 laptop2 11.121.44.55 How do I search my index ( sourcetype="device_assets" ) for the CSV IPs and return whether or not each IP is found within the index? An example result would be: device_name ip found router1 122.145.11.2 Yes laptop2 11.121.44.55 No Important note: The solution CANNOT use |join command because this is very intensive/slow for my current deployment. Thanks ... View more

The new myTime field is blank for some reason -- anyone know why? Consider the below code I'm using: |makeresults |eval originalTime = "01/05/19" |eval myTime = strptime(originalTime, "%m/%d/%Y") |table originalTime myTime Oddly enough, it DOES work if I use |eval originalTime = "11:55" with eval myTime = strptime(originalTime, "%H:%M") . Why won't my original query work? Because of this, I'm unable to convert time to UNIX time in my CSVs. ... View more

Hi, How do I search through a field like field_a for its unique values and then return the counts of each value in a new table? example.csv field_a purple purple purple gold gold black How do I return a table that looks like this: newField count purple 3 gold 2 black 1 In reality I have hundreds of values so the query needs to be able to find all unique values, not just "purple", "gold", and "black". Thank you. ... View more

Hi, I've merged two lookup files using this query: |inputlookup master_inventory.csv |join type=inner IP [|inputlookup personal_inventory.csv] The (condensed/sanitized) table looks like this: IP tool1_ip tool2_ip date location tool3_mac tool4_mac 11.11.11.11 20181029 Krypton abcd1234 22.22.22.222 22.22.22.222 22.22.22.222 20181029 Hogwarts 5678hijk 5678hijk 33.33.333.333 33.33.333.333 20181029 US wxyz1111 How do I display the count of how many times each value appears in specified fields? (The specific fields would be tool1_ip , tool2_ip , tool3_mac , and tool4_mac ). Maybe using mvappend() would help with this issue? Anyway, the result should spit out a table that looks like this: IP ip_appears mac mac_appears 11.11.11.11 0 abcd1234 1 22.22.22.222 2 5678hijk 2 33.33.333.333 1 wxyz1111 1 Important notes: 1. The solution needs to be scale-able and not limited to the 2-3 rows/events I have above. In my real data, there are hundreds of rows/events. 2. Each tool# field is actually named after different asset management software, like ServiceNow or Solarwinds. 3. All mac address values are not separated by colons (:) in my data (unfortunately). 4. Thank you for your help! ... View more