The below search is intended to get status codes from two different sources and put them together in a table. It works except that it keeps codes separate if they come from different searches. In the table at the bottom, I want only one row for 504, with entries for both searches and the sum (=5).  | multisearch [search index=ABC status.code>399 | rename status.code as StatusCode | eval type="search1"] [search index=DEF data.status>399 | rename data.status as StatusCode | eval type="search2"] | chart count over StatusCode by type | eval sum = search1+search2 StatusCode search1 search2 sum 1 400 17 0 17 2 406 10 0 10 3 500 647 0 647 4 504 0 1 1 5 504 4 0 4 6 530 8 0 8 ... View more

I was asked to archive search results in a CSV then send those results periodically by email. My solution is to do this in 2 reports. The first report runs the search and appends the results to a lookup. The second just grabs the entire lookup (| inputlookup my_lookup.csv) then emails the results as a CSV.  This seems to work fine but I feel like there should be a more elegant solution, like in only one search/report. I'm curious about what others think.  ... View more

I have a field value like this that I want to exclude.   [22minfo[3: host.console[0]   The searches I can think of either don't do anything or return an error. Note, I am trying to speed up a search so I do not want to use regex.  Searches I tried:     message != [* message != "["* message != "[*" message != '[*' message != '['*     ... View more