I also took a similar approach based on your answer. I used a scripted input to download the csv I needed and pull it into an index and then your sourcetype for formatting.    ../app/bin/download_csv.sh Ensure that this file has the right permissions for the splunkd user, I also ensured that it was executable.    #!/bin/bash URL="https://www.somesite.com/myfile.csv" curl -k -s $URL     ../app/local/inputs.conf   [script://./bin/download_csv.sh] disabled = false interval = * * * * * index = myindex sourcetype = mytype_csv     ../app/local/props.conf   [mytype_csv] DATETIME_CONFIG=CURRENT NO_BINARY_CHECK=true INDEXED_EXTRACTIONS=CSV HEADER_FIELD_LINE_NUMBER=1   Then I'll update the csv in a similar fashion to your own with the search.  ... View more

Was this feature added onto the UI? ... View more

I had to make a few more tweaks. Because the initial search is doing stats on each set of results, the output of the search (and thus the join) is not a "stream" but a stats table. Despite my belief that my columns were already multi-values, they were not (apparently) and I had to split them. Because it was table, streamstats didn't work. A simple switch to "stats" did the trick, So the final answer is: ... | eval tmp = mvappend(split(colA, " "), split(colB, " ")) | stats count by key,tmp | eval result=if(count=1,tmp,"") | fields - count tmp mvcombine result ... View more

Hey @mbintz, Are you able to get the animation work ? I'm searching for something similar too ... View more

Probably throw a fillnull for subtype before first stats, as it can be null/empty and stats will ignore the type without a subtype. ... View more