Hey! Drop me a message I will explain You how to achieve that. ... View more

Given that no real hostname begins with pound sign, you can use ltrim. index="inm_inventory" |dedup vm_name | search vm_name="*old*" OR vm_name="*restore*" | eval vm_name = ltrim(mvindex(split(vm_name, " "), 0), "#") |table inventory_date, region, vm_name, version ltrim and split use fixed patterns,  therefore less compute and RAM. ... View more

index=standard_tanium source="Prod-CSV" script=read.ps1" |rename field01 as user |rename field02 as login-count |rename CSV-Timestamp as Script_run |rex mode=sed field=user "/[&?].*//g" |table Script_run IDBC-Hostname user login-count |lookup read-login.csv user-id as user OUTPUTNEW user-id |lookup owner.csv hostname as IDBC-Hostname OUTPUTNEW tier sownername servicename |search user-id=* |sort -login-count |stats values(*) as * by Script_run IDBC-Hostname user login-count |table Script_run IDBC-Hostname user login-count tier sownername servicename ... View more

Assuming each group is a separate event and each event is multi-lined, try something like this | extract pairdelim="\n" kvdelim="-" | eval {key}=value | fields - key value | stats values(*) as * by hostname If not, please share you events in a code block (similar to above code using the </> button), so we can see what you are actually dealing with ... View more

Hello @srv007, I'm a Splunk Community Moderator, Kindly accept the answer posted by @gcusello ,  as that's the answer to your question. On my post, you can add "Karma/Upvote" if you like it. That would be appreciated!!   Thanks @srv007 , Happy Splunking!!! ... View more