That worked!  Thank you for your patience helping me diagnose the issue. ... View more

Here you go:   ... View more

I think I'm not using the right words. My apologies. This is all a bit confusing. Let me start from the top with some better examples. Be aware that I might not be using the right Splunk or SQL terminology. We have a database table with data that I want to display like an Excel pivot table would. Here's a subset of the table with actual column names (fields?) and some sample data: category_id url dts 1 scamurl1 2/1/2023 1 scamurl2 2/1/2023 2 phishingurl1 2/2/2023 2 phishingurl2 2/3/2023 3 maliciousurl1 2/3/2023 1 scamurl3 2/3/2023 3 maliciousurl2 2/4/2023 2 phishingurl3 2/4/2023 2 phishingurl4 2/4/2023 What I'd like to do is display this data in a dashboard that looks like this: Date Scam Phishing Malicious 2/1/2023 2 0 0 2/2/2023 0 1 0 2/3/2023 1 1 1 2/4/2023 0 2 1 In other words, I want to create a pivot table that has a row for each day (going back one month) and displays a count of the URLs in each category that day. And I want that pivot table to show aliases for the category numbers at the top. Is that doable? I sure appreciate your time and assistance. ... View more

It originates from the dts field based on this part of the original query: DATE_FORMAT(date(dts),GET_FORMAT(DATE,'USA')) as rate_date I should have shown the example in the actual format the query displays it in:  02.01.2023. ... View more

These are the fields in the table: auto_cascade buff_status category_id directory domain dts norateflag port regex_unrated_value regexid review_later root_domain_id source type url Thanks so much! ... View more

When I append that string to the end of my query, it returns "No results found." pretty quickly.  When I remove it, I get data.  Any ideas? Thank you for your help. ... View more

I think I figured it out.  See Update #3 above.  I appreciate the assist! ... View more

Good idea--I thought of that too, but the table still returns gazillions of records that don't match, and the url and ipaddress fields are blank.  I'd like to see in the table only records that have a matching IP (see reply above).  Thanks again! ... View more

Update #2: So when I add a field for the ip address and display it in the table and sort on that column, I find matching results (yay!), but I'm also getting tons of records that don't match.  Here's the new query:   sourcetype="datasource.out" | rex field=_raw "(?<ipaddress>1.2.3.4) lookup\] \: (?<url>[\w\:\/\.\-]+)" | table _time url ipaddress   Is there a way to update the query to exclude non-matches from the table? ... View more

Update:  It does appear to return every row from the raw field (or at least many more than have the specific IP), but when I sorted on the empty url column, I found that there are some rows with data, but they're not all URLs. ... View more

Partly works--see above reply.  Thanks for your help. ... View more

It does return a table with the date/time in one column, but the url column is blank.  It appears to be returning a row for every row during the date range.  I know I have rows with the IP in the _raw field because I get back rows when I search my source for just the IP in quotes.  And the regex looks good.  From regex101: Ideas? ... View more