@niketnilay I think I may have figured it out. I wanted to preserve the respective type of controller for a given site but I only wanted the user to see their site name. So I concatenated the two together from the CSV with delimiter ";". Then I performed eval for $host$ and $controller$ , with the latter using mvindex to split by the delimiter. See below. Thank you so much for your help! <form> <label>Saved Search Based on Token</label> <fieldset> <input type="dropdown" token="site_controller"> <label>Site Selection</label> <fieldForLabel>Site</fieldForLabel> <fieldForValue>Site_Controller</fieldForValue> <search> <query>| inputlookup Site_Mapping.csv | strcat Site ";" Controller Site_Controller | table Site Site_Controller</query> <earliest>-1s</earliest> <latest>now</latest> </search> <change> <eval token="host">$label$</eval> <eval token="controller">mvindex(split($value$, ";"),1)</eval> </change> </input> </fieldset> <row depends="$controller$"> <panel> <title>Failure Rate Panel $controller$</title> <table> <search> <query>| savedsearch $controller$_Failure Rate host="$host$" </query> <earliest>-2w@w</earliest> <latest>now</latest> </search> <option name="drilldown">cell</option> </table> </panel> </row> </form> ... View more

As others have indicated, the combined solution should be replacing your last line with something like this: | where (error_count>0 AND qualify_count>0 AND patient_count>0) OR (error_count=qualify_count) ... View more

How about this? If the order of different types of error is fixed, they try like this Your base search | rex "NECU Error:\s*(?<NECU_ERROR>.+)([\r\n]+)FCU Error:\s*(?<FCU_Error>.+)([\r\n]+)RCU Error:\s*(?<RCU_Error>.+)([\r\n]+)SGCU Error:\s*(?<SGCU_Error>.+)" If not then, try like htis your base search | rex "NECU Error:\s*(?<NECU_ERROR>.+)" | rex "FCU Error:\s*(?<FCU_Error>.+)" | rex "RCU Error:\s*(?<RCU_Error>.+)" | rex "SGCU Error:\s*(?<SGCU_Error>.+)" ... View more

Hey there, This should grab all the errors per event into one single field. | rex "Transitioned\sto\sError\sState\s+(?<ALL_ERROR_LINES>[\n\r\s\S\d]+)" If you want to extract those errors individually. | rex max_match=10 "^(?<AA>[A-Z]+\sError:\s[^\n]+)" Or something more granular like field=value (ie: error_type=NECU msg="[0x0] _SynchronizationSGCUTimeout : Timeslice: 163 Submap: 83"), something like this should work. props.conf [your_sourcetype] REPORT-multi_errors = multi_error_values transforms.conf [multi_error_values] REGEX = ^(?<_KEY_1>[A-Z]+\sError):\s(?<_VAL_1>[^\n]+) REPEAT_MATCH = true CLEAN_KEYS = 1 Hope it helps. ... View more

you'd want to use |fillnull rcu_msg value="N/A" first, though, I believe for that blank row. ... View more

I have re-edited my search to explain the parts. ... View more

I have reposted my question here (changed the question a little bit): https://answers.splunk.com/answers/513490/how-to-extract-desired-information-from-transactio.html?minQuestionBodyLength=80 Can I close this question? ... View more

Try this: index="logs" process=beamCommonProcess "Transitioned to Error State" OR "SET_RANGE activity requested for beam supply point" OR "DISABLE_BEAM activity is complete" OR "Timeslice:" | transaction startswith="SET_RANGE activity requested for beam supply point" endswith="DISABLE_BEAM activity is complete" | search "Transitioned to Error State" | rex "\sNECU Error: \[0x\d+\].*?Timeslice: (?<necu_timeslice>\d+)" | rex "\sFCU Error: \[0x\d+\].*?Timeslice: (?<fcu_timeslice>\d+)" | rex "\sRCU Error: \[0x\d+\].*?Timeslice: (?<rcu_timeslice>\d+)\sSubmap: \d+\s*\((?<rcu_msg>.*?)\)" | rex "\sSGCU Error: \[0x\d+\].*?Timeslice: (?<sgcu_timeslice>\d+)\sSubmap: \d+\s*\((?<sgcu_msg>.*?)\)" | eval minTS = min(necu_timeslice,fcu_timeslice,rcu_timeslice,sgcu_timeslice) | eval output = case(isnull(minTS),"TimeoutEnablingBeam", necu_timeslice=fcu_timeslice and fcu_timeslice=rcu_timeslice and rcu_timeslice=sgcu_timeslice,"TSS Enable", minTS==necu_timeslice,necu_msg, minTS==fcu_timeslice,fcu_msg, minTS==rcu_timeslice,rcu_msg, minTS==sgcu_timeslice,sgcu_msg, 1==1,"Unknown") | eval minTS = if(isnull(minTS), "No Timeslice", minTS) | table _time minTS output | sort _time Note that the case statement stops when it finds the first match. So I put the test for "no timeslice" up front, followed by the test for "timeout enabling Beam." I also moved the eval for minTS to after the case statement. ... View more