I am having a random issue where it seems characters are present in a field which cannot be seen. If you look in the results below, even though the results appear to match each other, Splunk does see these as 2 distinct values.  If I download and open the results, one of the two names has characters in it that are not seen when looking at the results in the Search App. If I open the file in my text editor, one of the two names is in quotes, if I open the file in Excel, one of the two names is preceded by ‚Äã. It feels like a problem with the underlying  lookup files (.csv),  however this problem is not consistent, only a very small percentage of results has this incorrect format (<.005%).  Trying to use regex or replace to remove non-alphanumeric values in a field does not seem to work, I am at a loss with it.  Any idea how to remove "non-visible" characters or correct this formatting?   ... View more

I have a lookup table I am using to pull in contact information based on correlation of a couple of fields. The way the lookup table is formatted, it makes my results look different than what I want to see. If I can consolidate the lookup table, it will fix my issue, but I can't figure out how to do it. The table currently looks like this: Org Branch Role Name Org A Branch 1 President Jack Org A Branch 1 VP Jill Org A Branch 1 Manager Mary Org A Branch 2 President Hansel Org A Branch 2 VP Gretel Org A Branch 3 VP Mickey Org A Branch 3 Manager Minnie   I use the Org and Branch as matching criteria and want to pull out the names for each role.  I do not want to see multivalue fields when I am done, the current search looks like: [base search] | lookup orgchart Org Branch OUTPUTNEW Role | mvexpand Role | lookup orgchart Org Branch Role OUTPUTNEW Name This works, but the mvexpand (obviously) creates a new line for each role and I do not want multiple lines for each in my final results.  I want a single line for every Org/Branch pair showing all the Roles and names.  I am thinking the way of solving this is reformatting the lookup table to look like the table below, then modifying my lookup.  Is there a way to "transpose" just the 2 fields?  [base search] | lookup orgchart Org Branch OUTPUTNEW President, VP, Manager Org Branch President VP Manager Org A Branch 1 Jack Jill Mary Org A Branch 2 Hansel Gretel   Org A Branch 3   MIckey Minnie     Thank you! ... View more

I am using 2 lookup tables to correlate and combine data to create a new .csv. In this process, I have a field that has numerical values in it that i want to sum based on the values of another field.  The raw data looks something like this: stage,resource,hours x,rick,1 x,rick,10 x,dave,1 y,rick,5 y,dave,3 y,dave,8   I want the output to look like: x,rick,11 x,dave,1 y,rick,5 y,dave,11   Below is the search I have, it almost works but it does not sum the totals for rick and dave individually, it sums them all, so the output looks like: x,rick,12 x,dave,12 y,rick,16 y,dave,16   |inputlookup mod_master |lookup lookuptable1 Engagement OUTPUTNEW ResourceLastName,RegularHours | eval Resource=mvdedup(ResourceLastName) | mvexpand Resource | eval Hours=sum(RegularHours) | fillnull value=0 Hours | table Stage,Resource,Hours     How can i change the logic in this search so I get the correct individual sums for Rick and Dave and not the combined total for each? Thank you in advance!   ... View more

I have a csv file that that I am using for a lookup which has multiple values in a particular field. I am trying to do a lookup which matches any one of the field values. example: lookup table file - room,color livingroom,purple|green|yellow (the pipe symbol delineates the different values in the color field) Then my search - <base search>  | lookup paint_colors room OUTPUTNEW color | search color=purple | fields room,color | stats list by room My desired result would be to see livingroom in the results. Is it possible to search for any one value in a field with multiple values? Thanks in advance!     ... View more

Has anyone ever set up a script to monitor ESTABLISHED sessions for Windows using a netstat command? I was looking to copy/modify the win_listening_ports.bat script that is part of the Splunk for Windows app but am not having much luck. I want to gather local address:local port and foreign address:foreign port, can anyone help? BTW - I am aware of the WinNetMon inbound;outbound monitors that are part of the same Windows app. I don't want to capture all connections, rather see a snapshot at specified intervals, like once hourly. Thanks in advance! ... View more