Hello, I have a lookup table with fields user and src. I want to table results [user src] where the src within my search != the src listed within the lookup table. So first I need to search for matching user rows, then I need to compare the src of the search with the src value in the lookup file. If the src is different, I want to table the new src value from the search. Can someone help me with this?  Thanks so very much. ... View more

I am interested in only listing transactions of a given source entity that contain multiple events.  Is there a quick and easy way to do this? index=main | transaction src_entity startswith=at least one thing endswith=another thing | table src dst etc. ... View more

I have email logs within index=Email and suspicious domain connections within index=Security. The field name within Security = domain (values look like "website.com") The field of interest in Email = URL (values look like https://www.corp.website.com/page1/page2/etc:443) I need to search index=Email and do a sub-search within index=Security and only return results if domain is contained within URL. I tried things like:   index=Email [search index=Security | where like(URL, "%"."domain"."%")]   Anyone that can help me you will make my week!  Thanks for your time.     ... View more

Hello, I am interested in making the results of one index search (in particular the values of fields early and late) used in a different index search as values assigned to earliest latest.  index="a" <find a specific event> | eval timeTOsecs=strftime(_time, "%s") | eval early_time= timeTOsecs-300 | eval late_time= timeTOsecs+300 | eval early=strftime(early_time, "%m/%d/%Y:%H:%M:%S") | eval late=strftime(late_time, "%m/%d/%Y:%H:%M:%S") My next search would search for all events using the early and late values of the previous search and assign them to earliest latest. index="b" earliest=early latest=late Everything I have tried up to this point seems to point to "earliest" and "latest" modifiers will not allow you to assign a field value to them.  Essentially I want to perform the function that Splunk automates through its UI when it lets the user run a search on events before and after a given time.    Thanks for anyone that can help me and let me know if I can be clearer in explaining because sometimes it is hard to understand other people's context. ... View more