I will try and follow your directions and give it a shot.  Thanks, richgalloway! ... View more

I'm new to Splunk and was wondering about the same thing. on the context below, is that the beginning of the search string? usually it starts with index=.....    So what i'm trying to get is a lookup of  index=_internal* log_level=WARN OR log_level=ERR host=XPxx9* OR host=GPxx7* OR host=fsr*   but instead of listing like 30 of the host names with OR arguments, what's the ideal way to do it?   | tstats count WHERE index=* by index host| table index host | lookup inventory.csv "Server Name" as host OUTPUT "Application Name" | where isnotnull('Application Name') | rename index as Index host as "Server Name"   ... View more