I have a table that looks like this: Time Host User Activity 2021-01-01 01:02:01 ABC Test CommandLine: C:/Users/Cool/cool.exe File: cool.exe Hash: yr3f7r98jkfd7y38ykry73 2021-01-01 01:02:02 ABC Test CommandLine: C:/Users/Lame/lame.exe File: lame.exe Hash: kf39utkuk0ulftu39uk30utk 2021-01-01 01:02:03 ABC Test CommandLine: C:/Users/Idk/idk.exe File: idx.exe Hash: 9l09uk8dtyjy4j4098tk48   The query I used to made the table looks something like this: host=ABC User=Test | rename host AS Host | eval Time=strftime(_time,"%Y-%m-%d %H:%M:%S"),Activity=mvappend("CommandLine: ".CommandLine," ","File: ".File," ","Hash: ".Hash) | table Time Host User Activity | dedup consecutive=true Activity sortby Time I am trying to use a drilldown to make it so when I click the hash in my Dashboard, it redirects me to a website. The issue I'm have is when I add the link and I click the Hash, instead of just giving me the hash: "9l09uk8dtyjy4j4098tk48", it will give me entire cell "Hash: 9l09uk8dtyjy4j4098tk48" which bugs out my URL.   Expected Output: https://website.com/9l09uk8dtyjy4j4098tk48   Actual Output: https://website.com/Hash: 9l09uk8dtyjy4j4098tk48   Another issue is no matter what cell I click they will all try to redirect me to the website:   Example: https://website.com/CommandLine: C:/Users/Lame/lame.exe   How can I make it so I can only click the hash value to get my expected output? ... View more

Good Afternoon, I am trying to figure out a way to iterate through a list whenever the value is counted one time. I'm hoping it'll make mq so that way my query is speedier. Here's my current query: index=* eventtype IN(valueA,valueB,valueC) | stats count by eventtype and the result looks like this: eventtype                               count valueA                                        102 valueB                                        407 valueC                                       1034   What I'd like is a query where if the query finds the value in the field one time, move on to find the next value. This is how I want the output to look like: eventtype                               count valueA                                        1 valueB                                        1 valueC                                       1   Any help would be appreciated. ... View more

Good Afternoon, I am working on a coalesce query that looks like this:  | makeresults | eval Name="John", NAME="Johnny", name="john" | eval New_Name=coalesce("Name:;"+Name, "NAME:;"+NAME, "name:;"+name) | rex mode=sed field=New_Name "s/;/\n/g" | table New_Name The output I get is exactly what I'm looking for but is there a way I can simplify this? I'm trying to have the table display the field name with the coalesced value without having to type in the string before the value (ie:  "Name:;"+Name). Any help would be greatly appreciated. Respectfully, Jayson ... View more

Hello,   I'm relatively new to Splunk. I have multiple fields with different naming schemes that have different  or identical values. Here's an example:   hash=yj843yj387hfhjf723hjf47hnf29nf hashes=xmv98svmd89djmfv98jvkfj9jm Hashes=n9nuevur9vv9v8fj0fefjeffjv9ejve8 sha1_hash=84hmrh42mfu2hmxufxfmu28 src_hash=2xf9mf4jmfijjumrfx2r9mjfru2mjrm9j   name=jayson Src_name=jayson NAME=jayson SubjectUserName=jayson   I'm trying to make a query checks if there is a field that contains the word "hash" or "name" and tables it out. Here's what I have so far:   | eval Hash=hash, Hash=hashes | foreach Hash* [eval Hash=mvappend(Hash, "")] | eval Name=name, Name=Src_name | foreach Name* [eval Name=mvappend(Name, "") | table Name Hash I need to table the results from any field that has the word "hash" or "name" in it. Also is there a way to simplify this? ... View more