==Update== So if you have a file like below (call it tmsi_lookup.csv): tmsi,tmsi_old value1,value2 value3,value4 You can then do: source=mobile_source | lookup tmsi_lookup.csv tmsi_old OUTPUT tmsi This will take the " tmsi_old " field of events in source " mobile_source " and lookup the corresponding tmsi from the lookup file and populate it into the "tmsi" field. Does this help more? ==Orig== Map Command will do this. However, as mentioned by jonuwz, a more efficient search can be done if the sources all contain similar information. Example (with similar information) source=MySource1 OR source=MySource2 | stats sum(myField) by source Example (let's just mash a bunch of crap together) |inputlookup MySources.csv | map [ source=$sourcecsv$ | stats count ] The more information you provide, I can write better searches to get your end result. ... View more

I implemented this with a new sourcetype and input. I justified a new sourcetype because it is a different model than iis, and has different fields available. inputs.conf on the IIS Server [monitor://%SYSTEM_DRIVE%/inetpublogs/AdvancedLogs/*] sourcetype=iis_advanced props.conf on the INDERXER [iis_advanced] TZ = GMT ... View more

You can do this in props.conf. Both fields will be visible. [my_sourcetype] FIELDALIAS-alias1 = ip AS clientip FIELDALIAS-alias2 = uri-query AS uri etc... ... View more

So there are two ways. index=xx source=/xx.log | rex field=your_field "(?<your_new_field>REGEX)"| table your_new_field This shows only the value of the captured regex. index=xx source=/xx.log | regex _raw="REGEX" This keeps only the events that match REGEX. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Regex http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex ... View more