| fieldsummary | search values=*\"value\":\"<what value you exactly want to check>\"* | table field ... View more

I am browsing to look for a solution to this issue and eventually accidentally found a solution myself. Try if this will work for you.  search sourcetype=type1 field1='$arg1$' | rename field2 as query | fields query | eval newField=query  Single quotes will return the value of the field in an eval expression. ... View more

Worked like a charm. Thanks! ... View more

It'd take a bit of python or scripting work, and I'm not exactly sure about what the script would need to look like to be efficient, but you could potentially write an external lookup for this. There's a generic example about how this works in the docs, and an example script that ships with Splunk The idea is you have a single external lookup for splunk that takes csvfileIndex and surname and the script upon invocation dynamically retrieves addresses from the appropriate file(s), then your search is easy. (The script to accomplish this however...) ... View more

You may indeed be missing something, but I don't know what that would be. 😉 ... View more

No, subsearches are run before the main search. ... View more

+1 for | rename xml as _raw ... View more

I will have a look and try what you suggested. Thanks! ... View more