Hi @DougiieDee  This same question has also been asked and anwsered here https://community.splunk.com/t5/Splunk-Search/How-to-compare-today-hourly-stats-and-previous-week-same-day/td-p/635389/jump-to/first-unread-message   ... View more

when i add the static value All * it shows all value from that field name instead of the csv file value. ... View more

yourAccount  isnt a field name i have to regex it. Can i rex field yourAccount and search with only the account that i have in csv file?   ... View more

We need a lot more to work with.  As a guide, the body of a question should be longer than the subject. Start with the problem you are trying to solve.  Not the solution you're trying to get to work, but the actual problem itself as it's possible the solution you're trying is taking you in the wrong direction. Share some sample data and tell what you want to get out of it.  Since you mentioned regular expressions, share those, too. ... View more

I don't think so - if you do stats by operationId, Url you will only get one row for each unique combination of these fields, which is what you said you wanted. ... View more

@DougiieDee   | head 200      should work. ... View more

it didnt show any events ... View more

@DougiieDee  Can you try this? Just change the value_prefix from source= to your required one.   <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>source="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter>     ... View more

1. {\"errors\":[{\"code\"\"ABC-1000\",\"message\"\"Sorry we are unable to process your request. index=abc  ABC-* |rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_Code>ABC\-\d+)\"\,\"message\"\:\"(?P<Message>[^\"]+)" | where ABC_Code!="" | search ABC_Code=* | Stats count by ABC_Code Message 2. exception:CommonApplicationException ABC_1001:We're sorry, it looks like an error occured index=abc "exception":"CommonApplicationException" | rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)" | eval Message=substr(Message, 1, 140) | stats count by ABC_CODE, Message I have these two rex and want to combine both but because these two are different is it possible to combine them and have Stats count by ABC_Code Message? ... View more

\"exception\"\:\"\w+\.\w+\.\w+\.\w+\:\s+(?P<CODE>.*)\:(?<message>.*)\" ... View more