Hi, I am trying to run a search and have tokens setting various search items, what I need is to create a search from an input file and have one field referenced many times for different fields. My search is:     | inputlookup errorLogs | where RunStartTimeStamp == "2023-01-26-15.47.24.000000" | where HostName == "myhost.com" | where JobName == "runJob1" | where InvocationId == "daily" | fields RunID, ControllingRunID | uniq | format "(" "(" "OR" ")" "||" ")"       This gives:     ( ( ControllingRunID="12345" OR RunID="67890" ) )       What I would like is:     ( ( ControllingRunID="12345" OR RunID="67890" OR RunID="12345" OR ControllingRunID="67890") )       There could be many id pairs of run/controlling ID's and I want to search on any combination if possible. ... View more

Apologies, I am quite new to Splunk so not sure if this is possible, I have the following simple query:     | inputlookup appJobLogs | where match(MessageText, "(?i)general error") | rex mode=sed field=MessageText "s/, /\n/g" | sort RunStartTimeStamp asc, LogTimeStamp asc, LogID ASC       This works and gets the data I need for the error I am after, but, I want all associated values for the error by RunID. So the headers are: Host, InvocationID, Name, LogID, LogTS, LogName, MessageID, MessageText, RunID, RunTS, RunName I would like to do something like:     | inputlookup appJobLogs | where RunID in [ | search appJobLogs | where match(MessageText, "(?i)general error") | fields RunID ]     I have tried various forms and closest I got was a join which gave me the not found fields (should be fixable) but limited to 10,000 results so that seems like the wrong solution. ... View more

\Hi,   I have some data which looks likes this from a Splunk report: Server Prod1-Ver Prod1-Latest Prod2-Ver Prod2-Latest server1.com 11.7.1.2 11.7.1.2 8.2 8.3 server2.com 11.3.1.0 11.3.1.2|11.5.1.1 6.8 6.10|7.9 server3.com 11.7.0.2 11.7.1.1 7.4 6.10|7.9   I want to be able to compare the Prod-Ver to the corresponding Prod-Latest. Some of the latest ones will have different products for different point releases or, in the above example, 11.3 or 11.5 can be used, in that example, I need to check the 11.3.1.0 against the 11.3.1.2 and not the 11.5.1.1. I figure I will need to use mvexpand and have multiple rows, then exclude the ones not matching the higher point level.  Is there an easier way of doing it? to do what I suggested, I think I would need to have 4 versions of the same line (more when there are other products) to cover all combinations, i.e. server2.com line in above.   Thanks. ... View more