Hi, I still can't get any results. Here's an example of my search for: index="my-app" process="my-process" "string-condition-1" "main-string-condition": the contents of the Event column has: Feb 28 00:49:05 some_text more_text bla.bla.profile.updater: I, [2017-02-28_more_date_related_text] INFO -- : Updater: cached_user.update_action for **some_username** (*some_userID*) took 148.2ms My CSV file that I have uploaded, contains only 1 column (I read somewhere in Splunk doc that there has to be 2 columns minimum) which has a header: username. I'm trying to match the values under the CSV->Username column cells, against that big textual event, and I need to find the matched events between CSV->username and some_username (sub)string from the Events results. Can you suggest on how I can achieve that? ... View more