Hi, I have a query that goes something like this: index=myindex  | eval urgency="medium", account_name='awsMetadata.account.name' | stats count values(account_name) as account_name, values(urgency) as urgency I also have a CSV file which has the following columns and values env, project_name prod,prod_account11 dev,dev_account3 prod,prod_account55 qa,qa_account43 I wish to compare each of the results in the query above using "account_name" field with CSV file field "project_name", and if those two values match for each result, I wish to create a new field "env" in my results based on the "env" field from CSV file.  eg. if query result "prod_account55" from account_name field is found in CSV file "prod_account55" from project_name field, extract prod value from env field as a new field in the results.  ... View more

Hi,  I've configured an Alert to be sent to Email and AWS SNS. My query usually finds multiple results, when an alert gets sent to email, it's able to see all the results. However, when the alert is sent to AWS SNS, it only sees a single event (most likely the first one). I've looked at https://docs.splunk.com/Documentation/AddOns/released/AWS/ModularAlert but can't see anything related to enabling sending of all events. Anyone have a clue? The SNS alert looks like the following:   ... View more