Nice!!! This works great! I'm going to have to read up on "delim", "nomv" and "makemv" ... View more

Thanks for the response! Let me give this a shot ... View more

First sundareshr, thank you for your persistance in assistance. I appreciate your help. I updated my question with some pictures. I think my attempt at creating a table within this web-browser is more confusing than helpful. ... View more

Unfortunately, this did not do what I am hoping. I was hoping for a table that kept the groupings of users per row (user1,user2and user3 in one group with all of the values of the attributes associated with that group of users in the next collumn of the same row, with user4,user5,and user6 in the next row with all of the attributes associated with that group of users in the next column of that same row): username attribute user1 attribute 1 user2 attribute 2 user3 user4 attribute3 user5 attribute4 user6 This search (I apologize for the format, for some reason I cannot format this as code): basesearch|transaction attribute|table username, attribute | mvexpand username | stats values(attribute ) as attribute by username returned each username individually with all of the attributes associated with that individual username attribute user1 attribute 1 _______attribute 2 user2 attribute1 _______attribute2 user3 attribute3 _______attribute4 user4 attribute3 _______attribute4 Any other suggestions? ... View more

Looks like it might work - let me give it a go ... View more

I also do not see "Avg_count" option in step 4. What is the fix? ... View more

You are right somesoni2! Thank you! MY SEARCH | table location, _time, count,Species_ID Yielded: Location, _time, count, Species_ID Afognak River, 2015-05-11, 2, 420 Copper River, 2015-05-12, 6, 420 Afognak River, 2015-05-12, 11, 420 Copper River, 2015-05-13, 145, 420 Afognak River, 2015-05-13, 7, 420 etc. Which, when I clicked the "visualization" tab, turned into a really cool bubble chart. Thanks! ... View more

I had this same problem and |eval NewField=trim(OldField) worked great! Thank you so much! ... View more

NICE!! It worked! ... View more

Ok. Thank you. I will try this out and let you know how it goes. ... View more

Thank you so much for your patient instruction! I just updated my lookup table to look like: name,benefit,type *banana*,5,fruit and then I tried: |stats count | eval name="i want bananas" | lookup food name and it returned four columns, two of them containing values: count benefit type name 0 "i want bananas" So, something is working! I couldn't even get the columns to show up before... Perhaps it is because I do not know how to change transforms.conf On this page: http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Usefieldlookupstoaddinformationtoyourevents It said that: Use the Settings > Lookups > Lookup definitions page to define the lookup table or edit existing lookup definitions. You can specify the type of lookup (file-based or external) and whether or not it is time-based. Once you've defined the lookup table, you can invoke the lookup in a search (using the lookup command) or you can configure the lookup to occur automatically. Note: This is equivalent to defining your lookup in transforms.conf. On the Settings>Lookups>Lookup definitions page, I could not find a way to mimic "match_type=WILDCARD(name)" Is there a way to do that without editing transforms.conf? If not, how would I edit transforms.conf? ... View more

Step four. Unfortunatley, my food "names" are hidden in text. Do I need to do a rex command to create fields? ... View more

Nice! Thank you talla_ranjith! I appreciate how thorough you are ... View more

Thank you Renjith, I bet the answer is pretty simple. I just am having some difficulty here. The pages you referred me to are quite informative. I am grateful for your assistance. "food.csv" is the csv name as well as the lookup table name I uploaded into .../manager/search/data/lookup-table-files and the Lookup definition I created in .../manager/search/data/transforms/lookups I then followed the instructions found here: http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Usefieldlookupstoaddinformationtoyourevents to make my lookup automatic. Unfortunately, the fields I requested do not show up in the side bar. Nor does the field "name" appear there. I was hoping that the names from my csv would search all fields and return the corresponding results from the other columns. The field text is there though. ... View more

Works! Thank you! ... View more

I have an index I am trying to search. I have a seperate csv file containing a list of about 40 search terms with two metadata for each term: name,benefit,type banana,5,fruit ice cream,1,desert tomato,3,vegetable I want to then create a table with just the events with those names and the corresponding metadata. Is this feasible? I imagine I could use 40 individual eval functions but I would like to save time by using the csv file. When I attempt to implement the syntax: host=coolstuff | lookup food name OUTPUT type| table text, type I was hoping to get a table containing text with the particular food called out along with the corresponding type from the lookup file. Instead, when I ran the search, my search returns ALL the events (not just those with the food name) and then the statistics tab returns (0) - there is no table with just text or type. Can you help me troubleshoot where I went wrong? I've tried mixing up the syntax to get the results I want, but am just drawing a complete blank as to how to use this command. host=coolstuff | input food name (AS text) OUTPUT type | table text, type ... View more

Thanks MuS, I took time to try this out. The zoom dropdown works great! I am trying to implement a dropdown for center: <input type="dropdown" token="state_token" searchWhenChanged="true"> <label>Pick a State</label> <search> <query>host=coolstuff | dedup State | table State</query> <earliest>0</earliest> </search> <fieldForLabel>State</fieldForLabel> <fieldForValue>State</fieldForValue> <default>California</default> </input> <input type="dropdown" token="city_token" searchWhenChanged="true"> <label>Pick a City (must be on "All" to change State)</label> <search> <query>host=coolstuff State=$state_token$ | stats count by City | sort -count</query> <earliest>0</earliest> </search> <fieldForLabel>City</fieldForLabel> <fieldForValue>City</fieldForValue> <choice value="*">All</choice> <default>*</default> </input> My problem comes trying to implement these tokens into this field: <option name="mapping.map.center">(52.7,-124.45)</option> So, I currently have "mapping.map.center" default to: (52.7,-124.45) I tried replacing numbers with variables (i.e.: (latfield, longfield) and (avg(latfield),avg(longfield)) but it wasn't working. Any suggestions? ... View more

Nice! Thank you MuS! I have not "uncool" tag... I will give this a shot... ... View more

Thanks MuS! I will give this a go and let you know what happens. ... View more