Hi Splunk Community, I'm working on a search that analyzes an index containing records of file activity. Each event includes a field called FICHIER, which holds the name of the file. I have two lookup tables: ApplicationResponsibles.csv This contains mappings between application codes and their respective technical owners and email addresses. Columns: CodeApplication, ResponsableTI, Courriel FilesToExclude.csv This contains a list of filenames or filename patterns (with wildcards like *J69*) that should be excluded from the results. Column: Motif 🧩 Goal I want to produce a report that lists: Each application owner (ResponsableTI) Their email (Courriel) A list of application codes and the count of files associated with each code excluding any file that matches a pattern in the FilesToExclude.csv lookup. 🧪 What I’ve tried I attempted to use a subsearch with format and like() to dynamically build a where NOT clause, but I ran into multiple issues: format doesn’t seem to work well with like() expressions. lookup requires a key field, but I’m trying to use the lookup as a filter list. mvmap() and mvfilter() seem promising, but I’m struggling to apply them correctly to compare each event’s FICHIER against all motifs in the exclusion list. 🧠 What I need help with What’s the best way to dynamically exclude files based on a list of patterns (wildcards) stored in a lookup table? Is there a clean way to apply like(FICHIER, motif) across all motifs in the lookup? Should I restructure the lookup or use a different approach entirely? Any guidance or examples would be greatly appreciated! Thanks in advance 🙏 ... View more

Hello, I'm trying to add up the MIPS of each of the partitions per minute and then keep only the maximum MIPS per day but I'd like to display the time and minutes at which this peak arrived. How do I do it? Here's my search: First, I want to make the addition of the MIPS for all partition per minute. Second, I want to keep only the max value per day of the prior addition.     index=myindex  | bin span=1m _time | stats sum(MIPS) as MIPSParMinute by _time | timechart span=1d max(MIPSParMinute) as MaxMIPSParMinute | eval Day=strftime(_time,"%Y/%m/%d") | eval Hour=strftime(_time,"%H:%M") | sort 0 - MaxMIPSParMinute Day | dedup Day | table Day Hour MaxMIPSParMinute Unfortunaly, in my result I loose the hour and minute of when this peak occurs in the day.  Is there a way of keeping the hours and minute value?    Thanks! ... View more

Hello how can I display only 1 value of these 3 "maxCapacitMachine" results (which are the same in all 3 cases) in a BY timechart?   ... View more