Indeed, the objective is to utilize a lookup operation to match 'G01462' and find either 'G01462 - QA' or 'G01462 - SIT', or both. Alternatively, can I modify the lookup operation to precisely match the "newResource" field with the "Resource" field to retrieve the corresponding values of the "environment" field in the Application environment appOwner newResource Caliber Dicore - TCG foo@gmail.com Dicore-automat Keygroup G01462 - QA goo@gmail.com Dicore-automat Keygroup G01462 - SIT boo@gmail.com G01462-mgmt-foo ... View more

Done thank you @ITWhisperer  ... View more

Hi @ITWhisperer  yes that is resolved. No worries. @gcusello @ITWhisperer  please help This is the other issue which is related to csv dataset and lookup dataset. From this SPL: source="cmkcsv.csv" host="DESKTOP" index="cmk" sourcetype="cmkcsv" Getting output below Subscription  Resource  Key Vault  Secret  Expiration Date  Months BoB-foo  Dicore-automat  Dicore-automat-keycore Di core-tuubsp1sct  2022-07-28 -21 BoB-foo  Dicore-automat  Dicore-automat-keycore  Dicore-stor1scrt  2022-07-28 -21 BoB-foo  G01462-mgmt-foo  G86413-vaultcore  G86413-secret-foo   From this lookup: | inputlookup cmklookup.csv Getting output below Application environment appOwner Caliber Dicore - TCG foo@gmail.com Keygroup G01462 - QA goo@gmail.com Keygroup G01462 - SIT boo@gmail.com   Combine the two queries into one, where the output will only display results where the 'environment' and 'Resource' fields match. For instance, if 'G01462' matches in both fields across both datasets, it should be included in the output. How i can do this, could anyone help here to write spl. I wrote some of the Spls but it's not working for me. source="cmkcsv.csv" host="DESKTOP" index="cmk" sourcetype="cmkcsv" |join type=inner [ | inputlookup cmklookup.csv environment] source="cmkcsv.csv" host="DESKTOP" index="cmk" sourcetype="cmkcsv" | lookup cmklookup.csv environment AS "Resource" OUTPUT "environment" ... View more

@gcusello Yeah, understood and did the same thankyou. @ITWhisperer  any idea, need help here So now i ingested the csv file, from this i am getting the  index=foo host=nx7503 source=C:/*/mkd.csv Fields: Subscription Resource Key Vault Secret Expiration Date Months CSV file: Subscription  Resource  Key Vault  Secret  Expiration Date  Months BoB-foo  Dicore-automat  Dicore-automat-keycore Di core-tuubsp1sct  2022-07-28 -21 BoB-foo  Dicore-automat  Dicore-automat-keycore  Dicore-stor1scrt  2022-07-28 -21 BoB-foo  G01462-mgmt-foo  G86413-vaultcore  G86413-secret-foo  2022-09-01 -20 And from the lookup(foo.csv) Lookup: foo.csv Application environment appOwner Caliber Dicore - TCG foo@gmail.com Keygroup G01462 - QA goo@gmail.com Keygroup G01462 - SIT boo@gmail.com   when the "Expiration Date" match the "Resource" and "environment" trigger the alert and send mail to the respective emails(appOwner), how to get this. ... View more

@gcusello Thanks for you help to understand the issue.  Case1: Actually, there is no timestamp present in the provided csv. In the snapshot you're seeing the data is getting from sample i ingested from the dev machine via UF, here even i am not able to see in the events no "timestamp" field.    Case2: When i upload the csv in the data inputs, after selecting the sourcetype as "cmkcsv" there it is showing the timestamp field. So here whatever settings i added in the advance it's not at all removing the warning flag as "failed to parse timestamp defaulting to file modtime" [ cmkcsv ] DATETIME_CONFIG=CURRENT INDEXED_EXTRACTIONS=csv KV_MODE=none LINE_BREAKER=\n\W NO_BINARY_CHECK=true SHOULD_LINEMERGE=false TIME_FORMAT=%Y-%m-%d %H:%M:%S TRUNCATE=200 category=Structured description=Comma-separated value format. Set header and other settings in "Delimited Settings" disabled=false pulldown_type=true TIME_PREFIX=^\w+\s*\w+,\s*\w+,\s* MAX_TIMESTAMP_LOOKAHEAD=20   ... View more

@gcusello yeah i tried the data add via upload, there when i select sourcetype as csv there i can see the timestamp field.  ... View more

@bowesmana @gcusello @ITWhisperer  Thanks for your Ideas for helping me. finally, I did it with the below addition, it worked what i desired results. | rename host as Server, Name as Message | eval Severity=case( EventID="1068", "Warning", EventID="1", "Information", EventID="1021", "Warning", EventID="7011", "Warning", EventID="6006", "Warning", EventID="4227", "Warning", EventID="4231", "Warning", EventID="1069", "Critical", EventID="1205", "Critical", EventID="1254", "Critical", EventID="1282", "Critical") | fields Server, EventID, Message, Severity | search Severity="*$search$*" OR EventID="*$search$*" OR Server="*$search$*" OR Message="*$search$*" | table _time, Server, EventID, Message, Severity ... View more

@bowesmana unfortunately its not working, the only issue i guess is the custom filed "Severity" creating issue here. i tried a lot of different searches but no use. ... View more

@ITWhisperer  I tried the below search its not working at all. | where _time=$eventid$ OR EventID=$eventid$ OR Server=$eventid$ OR Message=$eventid$ OR Severity=$eventid$ When i keep this search in the pannel it gives all the desired results. But, when i search in the "textbox" like values of Severity(Critical or Warning or Information) its not working. when i search in the "textbox" like values of (EventID or Server or Message) it is working I think due to Severity is a custom field, so its not working i guess is this right? the EventID, Name as Message, host as Server fields are from _raw index=foo host=foo "$search$" OR Severity="$search$" | eval Severity=case(EventID="1068", "Warning", EventID="1", "Information", EventID="1021", "Warning", EventID="7011", "Warning", EventID="6006", "Warning", EventID="4227", "Warning", EventID="4231", "Warning", EventID="1069", "Critical", EventID="1205", "Critical", EventID="1254", "Critical", EventID="1282", "Critical") | rename Name as Message, host as Server | table _time EventID Server Message Severity any suggestions. ... View more

@gcusello @ITWhisperer  To clarify, my understanding is that if any fields are included in the '_raw' only will search for those fields, applicable to all input methods (text, dropdown, multi-select, and others). Is that correct? In this case what is the solution for custom fields like in my query where field ("Severity") values (Critical, Warning, Information). ... View more

@gcusello great, understood. Suppose when i want to search the Server field value (goo1) in the EventID Textbox, it will display the results of goo1, similar to other fields as well (Message, Severity) ... View more

@ITWhisperer No, its not about the search  | where _time=$eventid$ OR EventID=$eventid$ OR Server=$eventid$ OR Message=$eventid$ OR Severity=$eventid$ Make it as simple, when you search for specific values in any field (for example, EventID, Server, Message, or Severity) in the search input "Textbox", the system will display relevant data related to those fields. This allows for easy and straightforward searching based on the criteria. Reference Image: In the code I provided earlier, what changes are necessary for token-related conditions? ... View more

@gcusello Here is the code <row> <panel> <title>EventID-Severity Matrix</title> <input type="text" token="eventid" searchWhenChanged="true"> <label>Search EventID</label> </input> <table> <search> <query>index IN ("foo1", "foo2", "foo3") host IN ("goo1", "goo2", "goo3", "goo4") EventID IN ("1", "1021", "1069") Name=* $eventid$ |fields EventID Name host | eval Severity=case( EventID="1", "Information", EventID="1021", "Warning", EventID="1069", "Critical",) | rename Name as Message, host as Server | table _time, EventID, Server, Message, Severity</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> ... View more

@ITWhisperer  i created like this, in the Event Types     index=foo_win*  (host="PC*" EventID=1068) OR (host="PR**" EventID="1") OR (host="PR*" EventID="1") OR (host="PR*" EventID="1") | eval Severity=case(EventID="1068", "Warning", EventID="1", "Information", EventID="1021", "Warning") | stats count by Severity writing above spl under all three pannels(critical, warning,information) ... View more

@ITWhisperer extremely sorry to write in the table, need time as well. ... View more

@ITWhisperer thanks for the solution, i did little changes as per my desired results. ... View more

@ITWhisperer No, i mean like, i tried already as you suggested. From below said, under field PBC the field values comes under A00001, A00002 so for same other KCG and TTK as well, so these can show up in the table like above.  env="*A00001*" as "PBC" env="*A00002*" as "PBC" env="*A00005*" as "KCG env="*A00020*" as "TTK" ... View more

@ITWhisperer for this 3) edit your dashboard panel and change the x-axis title to none I have found the solution to this issue. I applied the following SPL code to the existing SPL, and the visualization updated automatically to reflect the changes. |timechart span=1d count |eval Date=strftime(_time, "%m/%d") |table Date, count   @ITWhisperer thanks for your time... ... View more

@ITWhisperer  in the events only 1 event getting, when you see in statistics getting same 2 values under destination in table. ... View more