Thank you @ITWhisperer  this saved my day.. I read so many posts and saw videos on how to change font size of column charts and your solution was spot on. ... View more

With such a simple csv, @scelikok approach is easier. index=<your index> NOT [|inputlookup <your csv> | format] ... View more

For fun,  Splunk 9 allows a special mode in foreach that can be used for this purpose. | stats count as Total by car status | foreach mode=multivalue status [eval <<ITEM>> = if(isnull(Total), 0, Total)] ... View more

try using https://regex101.com . You can test your regex statements prior to using them on splunk ... View more

This should be a new posting, but, yes, you can do that, however not using where.  To search only yesterday, use the earliest and latest options to the search command. index=foo earliest=-1d@d latest=@d   ... View more

Hi @Khuzair81, in this case you can use eval: | eval yesterday_start=relative_time(now(),"-1d@d"), yesterday_end=yesterday_start+86400 in this way you have the time borders of yesterday (in epochtime) and you can transform your Date in epochtime and filter your events. Ciao. Giuseppe ... View more

@Khuzair81  Can you please try this? YOUR_SEARCH | rex field=Language "^[a-zA-z]{4}(?<myval>\w+)\d{3}" | eval ans=case(c="US",myval, true(), "NA" ) | table ans, myval, c   My Sample Search :   | makeresults | eval c="US",Language="abcdENGLISH123qw" | rex field=Language "^[a-zA-z]{4}(?<myval>\w+)\d{3}" | eval ans=case(c="US",myval, true(), "NA" ) | table ans, myval, c   Thanks KV ▄︻̷̿┻̿═━一 If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. ... View more

@Khuzair81  Can you please try this? YOUR_SEARCH | eval c=split(c,","), Lang=split(Lang,",") | eval Ans = mvindex(Lang,mvfind(c,"US")) | table Ans   Here "US" is the value what I want to get Lang. My Sample Search : | makeresults | eval c="US,UAE",Lang="English,Arabic" | eval c=split(c,","), Lang=split(Lang,",") | eval Ans = mvindex(Lang,mvfind(c,"US")) | table Ans   Thanks KV ▄︻̷̿┻̿═━一 If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. ... View more

| rex field=field2 "\w(?<other>\[[^\]]+\])\w" ... View more

Hi @Khuzair81, as @richgalloway, said, you have to add a static option ("All") not associating to it "*" as usual (beacuse in this way you take all the countries) but the list of the wanted countries, e.g.: country="US"  OR country="UK" OR country="AUSTRALIA" Ciao. Giuseppe ... View more

Try this. <your base search> | eval username=coalesce(UserId, Ticket_no) | stats values(*) as * by username ... View more