I need to compare the values of 2 fields from the Splunk data with the field-values from the lookup and find the missing values from the Splunk data and output those missing field value pairs For ex: index=test  sourcetype=splunk_test_data fields: field1, field2 lookup: test_data.csv Fields: field1, field2 The output should show missing values from the Splunk data and output those missing values Any help would be appreciated  Thanks ... View more

I have created a tag for a key-value pair (dvc=IP_Address) and shared it will all the apps. Which doing a search for the logs related to the above device, I can see the tag appearing for that key value pair (dvc=IP_Address(Tag_Name)). However, this tag is not working for the notable events. It does not appear for the notables under Incident Review of Splunk ES. These tags were working prior to the new ES update. Looking for the solution regarding the same ... View more