Instead of just illustrating all SPLs, the best way to obtain concrete help is to first illustrate data - in your case, sample output from svc_summary - even data mockups to illustrate your observed variations, then illustrate the results you want from illustrated data, then explain the logic between data and desired results.  Like @livehybrid said, summary index or _internal is not the problem.  The problem is that volunteers here have difficulty understand your business logic. ... View more

In addition to what @PickleRick already points out, you need to clearly describe your use case - as opposed to throwing complex SPL searches at volunteers if you want to receive concrete help.  What kind of data are in indices si_error and internal_statistics? (Exemplify dataset.) What exactly do you expect as a result of "append" - or any other command? (Expected results.) What is the logic that connects your dataset to expected results?  As @SanjayReddy notes, there is no reason to expect "append" to not "always giving me only one section of the results."  You didn't even show sample results from each search to prove that "append" or any other command should give you more than "only one section of the results." I want to dig deeper on logic.  @SanjayReddy assumes that you want two fields (columns) Scada_count and dda_count in the same rows.  However, your first search, if it has output, is dominated by | stats count as Scada_count by Area.  This means that if there are more than one values for Area, this search will have more than one row of Scada_count. (If there is ever only one value of Area, why bother group by Area?) On the other hand, the second search can ever only produce one row of dda_count.  What exactly do you expect append to achieve? ... View more

You query shows the correct result but the fields are not in a order how I want to display. The easiest way to get the display order you wanted is to use table command, like | table _time API Total AvgDur TXN_1000 1sec-2sec 2sec-5sec 5sec+  @ITWhisperer already pointed out the mistake in your data emulation that is fixed by strptime.  The two method gives exactly the same result.  The only difference is in field names, which can easily be coordinated. ... View more

Your "table" must come with a sequence or the whole problem is unsolvable.  The sequence may come in the form of a _time field, or a special field such as sequence_number, or in the form of sheer order of the table. The whole point is, you can use transaction command to get what you need if your table Has a _time field and Is in reverse time order. | transaction "change #" "user ID" startswith="Mod_type=OLD" endswith="Mod_type=NEW" If, for any reason, your "table" doesn't come with a _time field, you can always make sure it is in reverse time order, and make up a _time field.  You can also use stats to do the same.  The bottom line is: join is seldom the answer. Here is a data emulation for you to play with and compare with real data. | makeresults format=csv data="Mod_type, user ID,Email,change #,Active NEW,123,Me@hotmail.com,152,Yes OLD,123,Me@hotmail.com,152,No" | eval _time = now() ... View more

I know you accepted an answer in Is there a way to group the data by time and another field? There is a simpler, perhaps more intuitive approach. index=my_app sourcetype=my_logs:hec (source=my_Logger) msgsource="*" msgtype="*MyClient*" host=* [ inputlookup My_Application_Mapping.csv | search Client="SomeBank" | table appl ] | eval total_milliseconds = 1000 * (strptime("00:" . elapsed, "%T.%N") - relative_time(now(), "-0d@d")) | eval timebucket = case(total_milliseconds <= 1000, "TXN_1000", total_milliseconds <= 2000, "1sec-2sec", total_milliseconds <= 5000, "2sec-5sec", true(), "5sec+") | rename msgsource as API | bucket _time span=1d | eventstats avg(total_milliseconds) as AvgDur by _time API | stats count by AvgDur _time API timebucket | tojson output_field=api_time _time API AvgDur | chart values(count) over api_time by timebucket | addtotals | spath input=api_time | rename time as _time | fields - api_time Main ideas: Organizing time bucket by case function is easier to maintain. Use chart command to perform transpose over one composite field (api_time). Use tojson to pack all information needed after transpose. In addition, using strptime to calculate total_milliseconds is more maintainable. (It would be even simpler if Splunk doesn't have a bug near epoc zero.) ... View more

| inputlookup append=t myhosts.csv Good suggestion.  I always forget the append option🙂 ... View more

Tried this, but I get a new row in table3.csv That is exactly what appendpipe is supposed to do.  If this is not acceptable, do not use appendpipe.  Have you tried fillnull @gcusello and I have suggested? ... View more

Make sure to apply fillnull before table | inputlookup table3.csv | fillnull field1,field2,comment3 value=- | table field1,field2,comment3 | outputlookup table3.csv   ... View more

Suppose you have a lookup called myhosts.csv; it has a field called host.  You use this as primary input, then find which host has zero count compared with index search. | inputlookup myhosts.csv | append [search index=sw tag=MemberServers sourcetype="windows PFirewall Log" | stats count by sourcetype,host] | stats values(sourcetype) as not_missing by host | where isnull(not_missing)   ... View more

Is there any specific reason why you must use your own regex to extract domain?  There are much more mature/robust algorithms, including Splunk's built-in transforms, e.g., url: | extract url | rex field=domain "(?<domain>.+)(?::(?<port>\d+))$" | rename proto as scheme (The url transform results in a field named "domain" that contains both domain and port. This is why I add a second extraction to separate port from domain. It also gives a field "proto" which you call scheme.) Here are some mock data for you to play with and compare with real data | makeresults format=csv data="_raw http://www.google.com/search?q=what%20about%20bob https://yahoo.com:443/ ftp://localhost:23/ ssh://1234:abcd:::21/" ``` data emulation above ``` They should give _raw domain port q scheme uri url http://www.google.com/search?q=what%20about%20bob www.google.com   what%20about%20bob http /search?q=what%20about%20bob http://www.google.com/search?q=what%20about%20bob https://yahoo.com:443/ yahoo.com 443   https / https://yahoo.com:443/ ftp://localhost:23/ localhost 23   ftp / ftp://localhost:23/ ssh://1234:abcd:::21/ 1234:abcd:: 21   ssh / ssh://1234:abcd:::21/ ... View more

Agree with @PickleRick that you need to clearly demonstrate raw data because the I don't think your raw log looks like what you show.  Is it more like the following? name|fname|desc|group|cat|exp|set|in abc|abc||Administrators;Users|S||1|1 bbb|bbb|Internal||N||2|2 ccc|ccc|MFT Service ID|Administrators;Users|S||3|3 In other words, it is multiline pipe (|) delimited text with a header line. (Like default table list from many SQL DBMS's.) The format shown in your original description cannot be reliably processed. If my speculation about your raw data is correct, you first change delimiter to comma, then use multikv to extract from the table, like this: | rex mode=sed "s/\|/,/g" | multikv forceheader=1 | table name fname desc group cat exp set in  Here is an emulation for you to play with and compare with real data: | makeresults | fields - _time | eval _raw = "name|fname|desc|group|cat|exp|set|in abc|abc||Administrators;Users|S||1|1 bbb|bbb|Internal||N||2|2 ccc|ccc|MFT Service ID|Administrators;Users|S||3|3" ``` data emulation above ``` Output from this emulation is name fname desc group cat exp set in abc abc   Administrators;Users S   1 1 bbb bbb Internal   N   2 2 ccc ccc MFT Service ID Administrators;Users S   3 3 ... View more

The OP is quite old.  It is possible that there was a bug in 9.2.3 that caused selectFirstSearchResult to not take effect.  I can confirm @tej57 's observation that the sample code behaves exactly as you asked in 9.4, too.       ... View more

Indeed lookups often end up with multivalue.  You need to make sure that every field to include have equal number of values. Usually I am in favor of JSON like in @livehybrid 's suggestion, although it should not be that complex; especially, one should not compose JSON with string.  More on JSON later.  There is an even simpler approach if you can enumerate fields to include: multikv.  No mvexpand needed.  Here is how: | eval _raw = mvappend("FunctionGroup,MsgNr,alarm_severity,area,equipment", mvzip(mvzip(mvzip(mvzip(FunctionGroup,MsgNr, ","), alarm_severity, ","), area), equipment, ",") ) | multikv forceheader=1 | fields - _raw linecount The idea is to compose a CSV table with mvzip, then extract from this table.  If composing nested mvzip is too much, or if you cannot easily enumerate fields to include, you can add foreach to your arsenal: | rename FunctionGroup as _raw | eval header = "FunctionGroup" | foreach MsgNr,alarm_severity,area,equipment [ eval _raw = mvzip(_raw, <<FIELD>>, ","), header = header . "," . "<<FIELD>>"] | eval _raw = mvappend(header, _raw) | multikv forceheader=1 | fields - _raw header linecount  Now, back to JSON - in this use case, it is more involved than multikv.  Again, with help of foreach and provided that your Splunk version is 8.1 or later, this is a semantic way to do it: | eval jcombo = json_object() | eval idx = mvrange(0, mvcount(FunctionGroup)) | foreach FunctionGroup MsgNr alarm_severity area equipment [ eval jcombo = json_set(jcombo, "<<FIELD>>", mvindex(<<FIELD>>, idx))] | fields - FunctionGroup MsgNr alarm_severity area equipment | mvexpand jcombo | fields - idx jcombo Of course, you can also do this without foreach. ... View more

Is this the result you are looking for? ID billing_date code latest(cost) _time 10001 2025-05-01 product2 135.75 2025-05-02 10:15:00 10001 2025-05-01 product3 155.00 2025-05-02 13:30:00 10001 2025-06-01 product1 102.50 2025-06-01 08:10:00 10001 2025-06-01 product2 130.75 2025-06-02 10:15:00 10001 2025-06-01 product3 150.00 2025-06-02 13:30:00 dedup with perfect sort as @PickleRick suggests should work.  Another way is to simply use stats as I originally suggested: | stats latest(cost) max(_time) as _time by ID billing_date code   ... View more

First, the mock data doesn't seem to agree with "update cost daily".  Wouldn't the following make more sense? bill_date ID Cost _time 6/1/25 1 1.24 2025-06-16 09:42:41.282 6/1/25 1 1.4 2025-06-06 09:00:41.282 5/1/25 1 2.5 2025-05-25 09:42:41.282 5/1/25 1 2.2 2025-05-15 09:00:41.282 5/1/25 2 3.2 2025-05-14 09:42:41.282 5/1/25 2 3.3 2025-05-04 09:00:41.282 3/1/25 1 4.4 2025-03-23 09:42:41.282 3/1/25 1 5 2025-03-18 09:00:41.282 3/1/25 2 6 2025-03-13 09:42:41.282 3/1/25 2 6.3 2025-03-03 08:00:41.282 Secondly, when you say latest event "of the month", I assume "month" can be represented by bill_date.  Is this correct? This is the search you need: | stats latest(Cost) as Cost by bill_date ID ... View more

You need to clarify a fundamental gap in your problem: What determines that it is instance3.com that is missing Search execution time, and not instance1.com, instance2.com, or any other Instance name?  Without a definitive condition, your task is an impossible one. ... View more

As I always say, do not treat structured data like text.  split is not the tool for this job.  @gcusello suggests INDEXED_EXTRACTION and a way to set up extraction in props.conf.  Short of these, you can also use multikv | multikv   ... View more

As @bowesmana points out, join is not the correct approach.  @livehybrid gives a logic that implements your requirements.  But the implementation inherits some convoluted logic in your original attempt. (The use of tstats requires that field System_Name is the same as host or is otherwise extracted at index time.  But your original SPL seems to imply the opposite.  I will not make such assumption below.) Your original expression | eval MISSING = if(isnull(last_seen_ago_in_seconds) OR last_seen_ago_in_seconds>7200,"MISSING","GOOD") really just says a System contained in system_info.csv is MISSING if no matching System_Name appears in sourcetype log, or a matching System_name appears in sourcetype log but is more than 2 hours ago. Is this correct?  There should be no need to even evaluate last_seen_ago_in_seconds if you simply filter search with earliest=-2h which is more efficient, too.  Additionally, the field MISSING is unnecessary in the table because it will always have value "MISSING" according to your logic. Here is a much simplified logic: index=servers sourcetype=logs earliest=-2h | stats latest(_time) as Time by System_Name sourcetype | append [inputlookup system_info.csv | fields System Location Responsible ``` ^^^ only necessary if there are more than these three fields ``` | rename System as System_Name] | stats values(sourcetype) as _last2hours values(Location) as Location values(Responsible) as Responsible by System_Name | where isnull(_last2hours)   ... View more

It shows that you think like SQL.  The API version in your examples is the easiest to extract in Splunk. (In fact, in any modern language other than SQL.) And using case function is about the most complicated method.  @livehybrid and @richgalloway suggested regex.  There is an even simpler and perhaps cheaper method: | eval version = mvindex(split(API_RESOURCE, "/"), 1)   ... View more