Hi  Ouput of my search result shows   FieldA ========= abcdabcdabcd001234 abcdef-gef exyza-123 xxxxyyyy-abcd     how to check or search for value of the result of FieldA that has only 18 characters   thanks in advance ... View more

Hi I have sample like this Source                                                                       Sample time from tx-templated                efghi examl from templated                         Sample time from [templated]        I want to extract the the values of last word as show below  Source                                                                  Extract Value Sample time from tx-templated               tx-templated efghi examl from templated                        templated Sample time from [templated]                   templated              how to do via regex?   Thanks in advance for help ... View more

Hi I am looking for query where say for example user=xyz which is present in multiple watchlists [watchlist_A.csv, watchlist_B.csv, watchlist_C.csv, watchlist_D.csv] and not present in watchlist_E.csv, watchlist_F.csv watchlist have columns [ number, user, date ]      1, xyz, 01022000       2, abc, 02022000   I am looking for query to use multiple watchlist and find value of my search say user=abc when queried should show a table as below  user, watchlistNames If result is present in multiple table it should give me the watclistnames where my search is user=abc and is present in watchlist_A.csv, watchlist_B.csv, watchlist_C.csv, watchlist_D.csv so my query result should be user, Watchlistnames abc,watchlist_A.csv, watchlist_B.csv, watchlist_C.csv, watchlist_D.csv ... View more

Hi  below is one of the requirement I have multiple lookuptable example  number  name   lookuptable 1               abc       1stlookuptable   number  name     lookuptable 1               abc       2ndlookuptable   number  name    lookuptable 1               dxc       3rdlookuptable   number  name    lookuptable 1               xyz       4thlookuptable   number  name    lookuptable 1               abc       5thlookuptable   requirement is how to build query where name=abc (from above example) to shows below table fields stating abc belong to which lookuptable on run name lookuptable   example out name  lookuptable abc       1stlookuptable                2ndlookuptable                5thlookuptable ... View more

Hi have a results from my mail index say log look like below sender=abc recipient=xyz@sample.com,ghi@nonsample.com country=abc sender=def recipient=team@nonsample.com country=xyz sender=gfh recipient=tip@nonsample.com country=efg sender=abc recipient=none@sample.com,sample@nonsample.com country=pqr I want to shows in a table only the non comma separated recipients only (as highlighted in bold where there are no multiple recipients)   can some one help me on this   ... View more

I am looking for something like this as below I have a seach string = rubi and want to check this string presence in a lookuptable = metals.csv Name         date                region rubi            12122021     abc diamond  12122022     def platinum   12122023    ghi what would be my splunk query to shows the presence of my search string with lookuptable. I want the result to be something like below Since in above example rubi is present in metals.csv my result table should look like with an extra column Present and status as Yes Name  Present rubi       Yes If not present say example searchstring=copper and is not present in metals.csv then output table should be Name      Present copper      No Note: I am giving the seachstring in text box of dashboard and want a result table as above ... View more

Hi Guys, I have a string say example : abc this string I want to lookup and match the presence in a lookup table  | lookuptable test.csv test.csv has value Number  Value 1 xyz 2 abc 3 mnp 4 wgf   I want to check the presence of my search string abc in lookup table and shows me yes or no in result table Like if found in lookuptable should result me as Yes else NO example abc is present in lookuptable so my output should be Search string Presence abc Yes   my search string abc | inputlookup test.csv| table value | rename value AS V1 | eval x="searchstring" | eval y="v1" | eval match=if(match(x,y),1,0) | where match=1 | table Searchstring, Yes   I tried this but didnt get result Kindly help me ! Thanks in advance ... View more