hi, this thing does work and provide the expected result, I have to say that i was hping to make it a bit simpler, but hey, if it works, it works. Thanks! ... View more

Hi, unfortunately no, I tried it.....to no avail. I have also tried with changing the mx_span using eval span=tonumber(mx_span), in case the maxspan does like only integer values, but it didn't work.   ... View more

Hi, thanks for the response. I spent a bit more time trying to narrow down the actual problem, and have some new findings. The year change actually happened only once, and it could have been because of a SPLUNK restart, or restart of some of the machines with the Forwarders(or any other event) however, i managed to find out that it is not the year change was that is the real problem . It seems that the search plays some game with us when searching for events. here is an explanation. An event is logged and existing(known date, know hour)  alert is triggered - correctly alert_fire event is logged correctly in _audit if  search for the actual event in logs (_main index)is performed using "All time" option, the event is present in the results if the search is performed using any "Relative" option the event is not present - despite the event being within the relative range if the search is performed using "Date range" or "Date and time range" with "before" sub-option, the event is there and it is fine. If i use the aforementioned options with "Since or Between" sub-options.....nothing That is for every type of event , and so far I do not see any connection to Sourcetype or Host.....   baffling isn't it....   ... View more

Hi, Thanks, I will try to explain it better. My client provides me a table(csv 1000x lines , 2 columns) with prefixes that I will be able to find in the logs from the monitored equipment. Based on those prefixes, I have to structure them, assign them new values, which we will use later. Based on what I have read, Lookup with wildcard in the lookup table is the solution to my challenge, and based on https://community.splunk.com/t5/Splunk-Search/Can-we-use-wildcard-characters-in-a-lookup-table/td-p/... I should be able to get exactly what i need, however , it still doesn't work.   I have tested your example, but it gets me exactly the same result. The wildcard does not match.   Kind regards! ... View more

Hi, Thanks for responding:) Exacltly the same. I feel like I am missing something. I can't even make the example work. As mentioned, I am now fighting to make the example from the link to work, and have completely put my put my case on the backburner. So here is what i have , and doesn't work: userlookup.csv user,username user*,USERNAME   transforms.conf [userlookup] batch_index_query = 0 case_sensitive_match = 1 filename = userlookup.csv match_type = WILDCARD(user) Props.conf [log2] LOOKUP-user = userlookup user OUTPUT username ...And for the full picture :   I think that the solution is in front of my eyes, but I fail to see it.   ... View more