@bowesmana 👍 That did the trick. Thanks. ... View more

@ITWhisperer @bowesmana  Thanks for your feedback and suggestions 👍 In reality the numField is like below: Am not sure why, but none of the suggestions & examples from previous replies worked when I referenced the above field name as-is. Conversions when tried resulted as below:   tostring(msg.Results.ErrorCode) resulted in Null tonumber(msg.Results.ErrorCode) resulted in a blank output eval isNum=if(isnum(msg.Results.ErrorCode),"IsNum","NotIsNum") resulted in NotIsNum   I then tried rename and all suggestions & trials with the renamed fieldname in the query from previous replies started to yield.   | rename msg.Results.ErrorCode as errorcode    Per Rename command it's used to give meaningful name to a field. The resultset is in Json and the field am interested in is a sub-level lookup. Is this not permissible for a query of this kind? Am puzzled! I know am working with a num field, but unsure why Splunk is responding differently 😕 Is this related to the Splunk version? Any insights. Thanks. ... View more

They are basically error codes like below. And the numField is a field in the log event. stringFieldConsistingOfNumsDelimitedBy# = "401#403#404#500" numField = 404   My another approach that didn't yield either: basequery | eval errorCodes=trim("401#403#404#500"), errorCodesArr=split(errorCodes,"#") | where IN(errorCodesArr, errorCode) ... View more

Thanks @bowesmana I corrected the script in splunk to remove the redundant col from the table. Appreciate your help. ... View more

Thanks bowesmana for the reference script. I made it to work like below:   basesearch | stats count as resultset by col1 col2 | where resultset > 0 | table col1, col2, col3 | lookup mylookupfile.csv col1 col2 OUTPUTNEW col3 | where isnotnull(col3) | rename col2 as newcol2    To send email notification for each record from the resultset, I saved as an alert and chose For each result in trigger, the trigger action is to send email. To had $result.col3$ and subject/message used $result.col1$ and $result.col2$. Apparently I need to use a different email template for the value from col2. I guess I'll need to look at the Run a script option from the list of trigger actions. ... View more