Hi Splunkers I'm looking for a way to append a column with an ID based on the value of another field. Base search gives this   index=transactionlog sourcetype=transaction earliest=-1h@h latest=@h | table _time Item Count   datetime=2025-03-10T08:59:59 Item=Apple Count=8 datetime=2025-03-10T08:59:45 Item=Banana Count=2 datetime=2025-03-10T08:58:39 Item=Apple Count=5 datetime=2025-03-10T08:58:25 Item=Coconut Count=1 datetime=2025-03-10T08:57:36 Item=Banana Count=2     _time Item Count ... Apple 8 ... Banana 2 ... Apple 5 ... Coconut 1 ... Banana 2 I'd like something that gives this _time Item Count ID ... Apple 8 1 ... Banana 2 2 ... Apple 5 1 ... Coconut 1 3 ... Banana 2 2   The ID is local, based only on the results. Each unique item is numbered.   I've tried streamstats count but this doesn't give the desired results.   Thanks all   ... View more

Hi all I am trying to append data to results based on a file. Example temperature and pressure are stored at 1 sample per minute all the time. The times when a batch was in production is logged in a look up file. Batch IDs are generated and stored after logging of sensor values to Splunk. Base search: index=ndx sourcetype=srctp (sensor=temperature OR sensor=pressure) earliest=-1d@d latest=@d | table _time sensor value Result: _time sensor value ... temperature 75 ... pressure 100   Look up file has 3 columns, the start and finish time for a batch and the ID startTime finishTime batchID ... ... b1 ... ... b2 ... ... b3   For each row in the result table of the base search, I want to append the batch ID to give _time sensor value batchID ... temperature 75 b2 ... pressure 100 b2   I have tried with | lookup batch.csv _time >= startTime, _time <= finishTime OUTPUTNEW batchID The lookup needs to find a batch where the value of _time >= startTime AND _time<=finishTime I can't see anything for lookup that works with this sort of conditions. Only where fields are a direct match. Any ideas would be appreciated, thanks in advance. ... View more