According to the Docs-Link provided by woodcock, depends is an "AND" logic where as rejects is an "OR" logic. ... View more

Thank you koshyk, I didn't get your suggestion working, I always get the following error: Error in 'makeresults' command: This command must be the first command of a search but it inspired me to change my querry like this: .... | rex field=bar "(?<foo2>\w+)\.\w+$" | rex field=bar "(?<foo3>\w+)$" | eval foo=if(match(bar,"bla"),foo3,foo2) That works fine for my requirements. ... View more

I've never used "lookup". With "search all" it should be possible to get alle source files. Is it maybe possible to use it like seache all sources in the last 24h and set the connection value to "0" for each source and combine the result of lookup and my querry? ... View more

@bosch_softtec... kindly read Splunk Community guideline and downvote only if the answer provided is incorrect or wrong. As you have already verified both the answers are correct. Query may be lengthy but might perform better. As it always exists with every question that there are multiple solutions, I was just giving you one more option. http://docs.splunk.com/Documentation/Splunkbase/splunkbase/Answers/Splunkcommunityguidelines You should ideally upvote all the options that work or help you and Accept the one that fits exactly as per your need. I am indeed glad that one of us was able to assist you. If rex has worked for you, next step for you should be to create a Field Extraction so that the regular expression persists as a Knowledge Object and is easy to maintain. http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX ... View more

Thanks for the dc() and table hint, I'll check it. Your adapted search is working with appendcols. ... View more

Hi, it could happen that there is no change in the header or first 256 bytes. Regarding your hint, i'll change the size of the initCrcLength to a higher value and check if my problem has gone. ... View more

Hi gokadroid, thanks for you answer, it's working 🙂 ... View more