Hi, I have a custom Python script developed in Splunk where it will translate Chinese characters to English. The custom search was built following the guide below: https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/ However, when we perform a search, the no. of Events does not tally with Statistics. For example, there are total of 8 events but only 1 in statistics. Sometimes it tallies, but most of the time it doesn't. Would like to know if this is a limitation within Splunk when using custom scripts or is there some configuration that is not taking place? Appreciate the help. ... View more

Hi, I have 2 queries: Query1: Message1,EventCode,Status aaaaa,4625,0XC0000234 Query2: Status,EventCode,action 0xC0000234,4625,denied 0XC0000234,4776,failure *note the lower and uppercase "x". Case sensitive In Query1, the status field is always uppercase (e.g. 0XC0000234 and not 0xC0000234 nor 0xc0000234) When i perform a search and lookup: index=a host=b | table Message1,EventCode,Status  | lookup blabla.csv Status OUTPUT action I'm getting the output: Message1,EventCode,Status,action aaaaa,4625,0XC0000234,failure Above is incorrect as 4625 should return "denied" instead of "failure" How do i do a lookup to first: Check the EventCode Return the corresponding action field with case insensitive Or is there a better way aside from the 2 points i mentioned above? Appreciate the help!   ... View more