Quite right. I have made more adjustments; see my updated answer which works for every file. ... View more

Yes I do, I ReRun below as your request : But its still happening same , only giving me those report which are belonging to excel file means that are match (46 records) but its should be those also which are not null in case of client column index=wineventlog host=ATLINFPSAS3 sourcetype="WinEventLog:Security" ApolloClientReports NOT "Symantec Endpoint Protection" EventCode="4663" Object_Name != "~" Account_Name!="svcirisadmin" | fields Object_Name Account_Name | eval path_segment = split(Object_Name,"\") | mvexpand path_segment | lookup NSAMasterListForClientReporting.csv entity_name as path_segment OUTPUTNEW entity_type | eval entity_type = if(match(path_segment,"\d{4}(_\d{2})?"), "report_period_folder",entity_type) | eval entity_type = if(match(path_segment,"..(txt|xlsx|pdf|csv|xls)"), "file_name",entity_type) | eval {entity_type} = path_segment | fillnull value="N/A" areport_type | fillnull value="NotDefined" client | fillnull value="N/A" report_period_folder | fillnull value="N/A" file_name | fillnull value="N/A" Account_Name | fillnull value="N/A" Object_Name | stats values(areport_type) as areport_type,values(sreport_type) as sreport_type,values(client) as client,values(file_name) as file_name, values(report_category) as report_category,values(report_period_folder) as report_period_folder by Object_Name Account_Name | search NOT sreport_type="" | rex field=file_name "(? [[:alnum:]]+)" | lookup NewMaster.csv entity_name as compareclient outputnew entity_type as entity_type1 | eval client=if(client="NotDefined",entity_type1,client) | stats count(file_name) as counttotal by Account_Name areport_type client report_period_folder file_name Object_Name | table Object_Name areport_type client report_period_folder file_name Account_Name counttotal ... View more

Agree with you @niketnilay ... View more

it not working if i am remove hardcoded value that is "R:\ClientReports\OpenCaseReport\DataFiles\AmeriHealth_Open\CaseReport_20101210.txt" with my column name ? Could You please help to resolve that. ... View more

Try the following: index=... | where ... | stats ... | sort ... | rex field=Object_Name "^(?<A>[^\\\\]+)\\\\(?<B>[^\\\\]+)\\\\(?<C>[^\\\\]+)\\\\(?<D>[^\\\\]+)\\\\(?<E>[^\\\\]+)\\\\(?<F>[^\\\\]+)" (The makeresults and eval line were just for testing purposes.) I changed "rex field=Object_name" to "rex field=Object_Name". Field names are case sensitive. If this does not work, could you post a screenshot of the results from this query? (Specifically of the Object_Name column.) You can use regex101.com for testing regular expressions. ... View more