This is what I found and it worked! First of all the message, "Can not communicate with task server......" is vague and does not give a clear idea so it can be so many reasons, few of them are 1. Updating the java_home path 2. checking the jre version 3. Checking if the HF has approved license or is connected to the License Manager (its no longer the license master) 4. Change the task server port to 9995 or 1025, instead of 9998 What I Did was this: in the SPLUNK_HOME/var/log/splunk/splunkd.log  is showed some error for dbx-migration.conf so i added these lines by creating dbx-migration.conf in /etc/apps/splunk_app_db_connect/local [encryption] disabled = 0 upgrade = DONE   Then a restart of splunkd. Works super smooth ... View more

sure. Last two lines can be rewritten as below to give a better idea | eventstats values(Parent) as tmp | eval found=if(isnull(mvfind(tmp,Hostname)),0,1) By using eventstats we create a list of "Parents" for each row. Host name is then matched against this list which returns null for non-matching and an index for matching records . The result is then evaluated using if and assigns to "found" . 1 and 0 can be replaced with any values for e.g. "Yes","No" etc Hope this helps! ... View more

| inputlookup my_csv | eventstats values(Parent) as parent_tmp | eval found=if(isnull(mvfind(parent_tmp,Host)),0,1) | where found!=1 | table Host Parent Version This gives what you are looking for. ... View more

@kacel, Try adding a by clause in your stats | inputlookup Obso_Inventory.csv | eval Compo=case(Composant="WAF", "LBWAF", Composant="LOAD BALANCER", "LBWAF", Composant="PROXY", "Browsing", Composant="FIREWALL", "Firewall", Composant="GATEWAY SSL", "Remote Access", Composant="GATEWAY SSL VPN", "Remote Access", Composant="IPS", "Anti-Intrusion", Composant="TAP", "Anti-Intrusion") | rename Compo as Composant | search Composant="Firewall" Editeur="*" Metier="*" Platform="*" Parent="*" | stats count as allFW , dc(Parent) as VSX_Instance by Platform ... View more