I have the following search to track search usage, i have a list of user who i want to track in a csv file. However, how do I add values that are in csv but not in my base search?  As in my base search some users are have 0 count.  im getting the following: username|count userA|100 userB|200 I would like to add missing user name in the lookup to my results like below: username|count userA|100 userB|200 userC| 0 userD| 0   | tstats `summariesonly` count from datamodel=Splunk_Audit.Search_Activity where (Search_Activity.info="granted" OR (Search_Activity.info="completed" Search_Activity.search_type="subsearch")) by Search_Activity.user | rename Search_Activity.* as * | sort + count | lookup ess_analyst_list.csv username as user OUTPUT username as users | where !isnull(users) | fields - users           ... View more

      | stats count | eval _time="1685158808" | eval rule_title="Test notable" | eval security_domain="Network" | eval urgency="Medium" | eval rule_name="Test rule" | eval dest="8.8.8.8" | eval src="1.1.1" | eval desc="Please investigate firewall log, and action" | sendalert notable param.mapfields=_time,desc,rule_id,rule_name,nes_fields,drilldown_name,drilldown_search,governance,control,default_owner,drilldown_earliest_offset,drilldown_latest_offset,next_steps,investigation_profiles,extract_artifacts,recommended_actions         Is it possible to use a timestamp to change the notable creation date time? it is creating notable everytime i hit search with the above query.` Additionally how do i move my description from below to the above description?       ... View more

I have set up my intel download however when i run `http_intel` multiple IOC/values are grouped into a single row.  How do i make it line by line with each unique value?   ... View more