The best way to understand the query is to run step by step. See the result change from "|inputlookup filename.csv" to "|inputlookup filename.csv | eval temp=1 | untable temp server content" . The columns have become the row labels and values of the columns are coming in a separate field called content. After that I'm charting max(temp) by content, just a placeholder to find which server has that content available. It'll 1 if a server has that content and null if it doesn't. The foreach loop is to loop through all server columns and replace 1 with the value of "content" per your desired output. ... View more

Assuming that your timezone is set to UTC (as the _time shows the date in UTC), try something like this to convert _time to any timezone that you specify in the eval (I'm converting to EST here) your base search with _time in UTC | eval _time=_time-(strptime(strftime(_time,"%Y-%m-%dT%H:%M:%S.%3N")." EST","%Y-%m-%dT%H:%M:%S.%N%Z")-_time) It's basically calculating the offset seconds automatically and substracting (or adding based on difference in current TZ versus one that you specify) in in the _time. ... View more

Thanks for the continued help, somesoni2. When I run the search it always comes back with just results from 1 index. When I run each of the searches independently I get the results I'm looking for. If I run the searches below they each return events (this is just your search broken out). The first search has the index of analysisFilesUserAccess and the second search has the index index of network. However, when I run both combined the results only has 1 index returned. Not sure why and this is causing no result returned. **(index=analysisFilesUserAccess [search index=network sourcetype=analysisFiles file_accessed="zip" | stats count by src_ip | table src_ip ] )** **(index=network sourcetype=analysisFiles file_accessed="zip" ) | stats values(hostname) as hostname values(data) as data If I look at the job inspector is get the message saying verify that the fields expected by the report commands are present in the events for the two fields that are supposed to come from the network index. ... View more

Only duplicates will be taken form the higher precedence .conf file ... View more

Thanks, the second one did the trick. ... View more

Thanks, Rich you're a genius. Did the trick. ... View more