Your title says 18 alphanumeric characters (which doesn't include punctuations like hyphen), but the text says 18 characters.  Which is it? To filter 18 alphanumeric characters, do | rex field=FieldA "^(<w18>\w{18})$" | where FieldA == w18 To filter for any 18 character | rex field=FieldA "^(<c18>.{18})$" | where FieldA == c18  or, more efficiently, | where len(FieldA) == 18 ... View more

| rex "(?<lastword>[\w-]+)\W*?$" ... View more

Hi @akshayinnamuri, please try something like this: <your_search> | lookup watchlist_A.csv user OUTPUT number AS number_watchlist_A.csv | lookup watchlist_B.csv user OUTPUT number AS number_watchlist_B.csv | lookup watchlist_C.csv user OUTPUT number AS number_watchlist_C.csv | lookup watchlist_D.csv user OUTPUT number AS number_watchlist_D.csv | table user number_watchlist_A.csv number_watchlist_B.csv number_watchlist_C.csv number_watchlist_D.csv Then, if you likem you can also put a status message (using eval) to indicate if some lookup is missing. Ciao. giuseppe ... View more

@akshayinnamuri    Values - without duplicate , list - with duplicates    | makeresults| eval lookupname="1stlookuptable",name="abc" | table name lookupname | append [ | makeresults | eval lookupname="2ndlookuptable",name="abc" | table name lookupname ] | append [ | makeresults | eval lookupname="3rdlookuptable",name="dxc" | table name lookupname ] | append [ | makeresults| eval lookupname="4thlookuptable",name="xyz" | table name lookupname ] | append [ | makeresults | eval lookupname="5thlookuptable",name="abc" | table name lookupname ] | stats list(lookupname) AS lookupname BY name ... View more

Thanks all, above didnt work.. however I tried  | eval recipient=split(recipient,","), rec_count=mvcount(rcpt) | where rec_count=1 |table ...   and got the result ... View more

| eval Name="rubi" | lookup metals.csv | eval Present=if(isnull(region),"No","Yes") ... View more

Firstly, you're mixing cases. With field names v1 is not the same as V1. Secondly, you're setting y to a literal "v1" string. It has nothing to do with the v1 field (mind also the case remark above). Thirdly, the match() function is a regex match. And lastly - will you be trying to integrate it into some bigger search? If so, then you'll probably need some another approach. ... View more