absolutely great, because it is also expandable to more than two datasets to be compared. here's what i done for a "triff": index=a | stats count by PSP_Element | rename * as a_* | rename a_PSP_Element as PSP_Element | eval a=1 | append [ | inputlookup koop_aws_spitz_zahlen PSP_Element=* | rename * as b_* | rename b_PSP_Element as PSP_Element | eval b=1 ] | selfjoin max=0 keepsingle=yes PSP_Element | append [ | makeresults format=csv data="PSP_Element F-330751 F-330755 F-330758 " | rename * as c_* | rename c_PSP_Element as PSP_Element | eval c=1 ] | selfjoin max=0 keepsingle=yes PSP_Element | where isnull(a) OR isnull(b) OR isnull(c) | eval x = coalesce(b_PLAN,a_Preis) | sort - x | fields - x | fields PSP_Element c a b * ... View more

Shouldn't it be ... table **previous_count* ...* ? your search here | stats count | appendcols [| inputlookup threshold | rename count as previous_count | table previous_count ] | eval trigger=if(count>300 AND previous_count<=300, 1, 0) | fields count trigger | outputlookup threshold ... View more

Actually what I am trying to do is add Instance ID or any TAG from EC2 instance to my apps event. But still I can't find a proper solution how to do that. Using host field is not reliable to match in lookup, because if instance going to be destroyed it's ip and host name release and will be assigned to newly created instance in future. As Instance ID is unique across whole AWS environmet I would like to use that. But in order to do that need add instance id to all events which I am forwarding with splunkforwarder. Instance ID are accessible with the curl command inside current running instance. Any idea on that? ... View more