Hi, I have csv file containing emailID and domain  and I would like to search the email exchanges between these two(emaild and domain) Csv file looks like below  emailID                                           domain test1@company.com             abc.com test2@company.com             xyz.com test3@company.com             some.com so on .......... based on the above I need to check how many time the emails exchanged between emailID and domain, I tried with below query but unable to get the result my search.... [| inputlookup test.csv | eval emailID = mvjoin(emailID ,",") | eval domain= "*@.".domain | eval condition1 = "Sender IN (".domain.") AND Rcpt IN (".emailID .") " | return $condition1 ] | table Sender Rcpt   ... View more

Hi, I need help in evaluation the csv files under "<Splunk directory>\etc\apps\search\lookups" folder. we have multiple csv files in this folder and I need to check which csv file is not in use or used for which search so that unused csv file can be deleted. ... View more

Hi, I have a requirement where my search displays the below result and the out is stored in CSV Now in another query I am inputting the CSV from the first search and trying to send an email for each filed value of "email_ID" with 20 line email body content, I have tried with the below query (without a email body as I don't know how to insert 20line email body ) but it is giving me an error. Also, please help me with how to insert 20line email body Search result :      email_ID                    Head_ID ----------------------------------------- abc@abc.com           abc_head@abc.com shri@abc.com           shri_head@abc.com xyz@abc.com           xyz_head@abc.com   query : | inputlookup email_ID.csv append=t | fields email_ID Head_ID  | sendemail from="emailaddress@abc.com" to="$email_ID$" cc="$Head_ID $" subject="emailtest" sendresults=true inline=true query  error:  command="sendemail", {} while sending mail to: ... View more

Hi, I need help in searching field value from the first search to another search with deferent sourcetype and combine both search fields in one table. but the issue is filed name is the same in both sourcetype but the values are different. example: Sourcetype 1 has filed name "user" with value "ABCD" sourcetype 2 has filed name "user" with value "xxx\\ABCD" I tried with below query but not getting the output sourcetype=sourcetype1 | eval User="*".User | table User | join User [search sourcetype=sourcetype2 | fields User HostName HostIP FileName Timestamp Message] | table User Email HostName HostIP FileName  Message ... View more