Hi All, This may be a bit of a peculiar question, but I'm trying to figure out if there's a way to use a certain expression in a search query to pull a "maximum" value based upon a custom table (.csv import) that is pulled into the query via the "lookup" command. The table has 4 possible "Attribute" values which range from "level-1-access" to "level-4-access". In the stats table, a given UserID may have activity that reflect 1 or more of these (thus, a maximum of 4 per UserID). Below is a sample dataset. What I'm attempting to do is filter this data so that it's only showing the "maximum" (or, "highest") value for each UserID. The rows bolded in green is what I'd want to see, with everything else excluded; thus, there should only be 1 row per distinct UserID. One possible thought that comes to mind is adding an numeric field to the .csv lookup, though still not 100% certain how to go about rendering the stats table to only include the highest value per UserID.  Any help would be appreciated. Thanks!  UserID Attribute jdoe level-1-access jdoe level-3-access jdoe level-4-access asmith level-1-access asmith level-2-access ejones level-3-access ejones level-4-access pthomas level-1-access pthomas level-2-access pthomas level-3-access pthomas level-4-access ... View more

Hello, I'm attempting to use the regex command to filter out any records on the "user" field that do not match the written expression below: index=myindex sourcetype=traceability_log4net earliest=-10d | regex _raw="user=[a-z]{3,6}[a-z1-9]{1,2}" | table user Per the expression, there should not be any "user" records that exceed 8 characters. However, the non-matching values are not being filtered out. "sstevenson6111", for example,  should theoretically be listed as "sstevens" per the expression.  I'm sure there's something blindingly obvious that I'm missing! 😳   ... View more