I am assuming that you asked this wrong and actually desire to know when there was a stop WITHOUT a start within 10-minutes.  If so: index="unix" AND sourcetype="syslog" AND centrifyEventID IN("17000", "17002") | reverse | streamstats count(eval(centrifyEventID="17000")) AS sessionID BY host | stats min(_time) AS _time range(_time) AS duration values(centrifyEventID) AS values dc(centrifyEventID) AS dc count BY sessionID host | rename COMMENT AS "Above is the setup, I *might* not have the logic exactly right below" | where (dc==1 AND values=="17002" AND (now() - _time) > (10 * 60)) OR (dc==2 AND range > (10 * 60)) ... View more

For others to construct a search, they will need to know which field in index zscaler can be matched with userID - I'll assume the same field name; which field in index zscaler represents user's E-mail - I'll assume the name userEmail, they will also need to know which field in index exomsgtrace represents outbound E-mail - I'll assume something like outgoingEmail, as well as further assume that's a multivalue; as well as how you want the result presented; in addition, what other characteristics are in zscaler and exomsgtrace because different characteristics can require very different search approaches. (These details should be described in the question and not leaving it to volunteers to speculate.)  For simplicity, I'll assume that there's no overlapping fields between the two indices, and userID, outgoingEmail are already extracted, and that you wanted a list of timestamps (_time), senders (sender), and subject (subject) in exomsgtrace when outgointEmail contains E-mail address of a matching userID, all of these fields already available in the index. Using these assumptions, what I assumed you wanted can be done with something like index=exomsgtrace OR (index=zscaler [| inputlookup leavers.csv | fields userID] ``` assume userID also exists in zscaler ```) | mvexpand outgoingEmail ``` outgoing Email could be multivalued ``` | eval userEmail = coalesce(userEmail, outgoingEmail) ``` use the same field name ``` | eval _time = if(index == zscaler, null(), _time) | stats values(_time) as _time values(sender) as sender values(subject) as subject by userEmail   ... View more

It depends on your lookup definition - there are some advanced options available   ... View more

You can use rex max_match=0 to get multiple matches ... View more

The short answer is no - SPL is not a procedural language The perhaps more helpful answer is, it depends on what you are trying to achieve. The thing to remember is that SPL processes a pipeline of events, each command in the pipeline processes the events and passes the results onto the next command in the pipeline. Using rex to match against the values in the field can help you do conditional processing e.g. if the field contains "command sent", as in your second example, you could extract the endpoint (you may have to adjust this depending on what your events actually look like) | rex field=msg "Security Agent uninstallation command sent.*,\s+\w+:\s+(?P<endpoint>.+)" Events which don't have a msg field which matches the anchor string will not have the endpoint field added to them, but all the events are passed on to the next command in the pipeline. Hopefully, that makes sense? ... View more