The stats command can't count what isn't there so you won't get a zero.  This query returns those access_users that are not in the web_hits table. | inputlookup local=t access_users.csv where NOT [| inputlookup web_hits.csv | fields user | rename user as access_user | format ]   ... View more

@mdeterville There are many (infinite!) ways to construct regular expressions. To capture everything between the first semicolon and either the second semicolon or the end of the line, you can use e.g.: | rex ".*?;(?<value>[^;$]+);?" $ is an anchor (a special token) representing the end of the string. The construct [^;$]+ means one or more characters not matching semicolon or end of string. The capture will stop when it encounters either of those characters. You can plug the regular expression into regex101.com or another tool to test it with a step by step explanation. ... View more

you can make use of same regex I shared above. for example:  1. Everything between the 3rd and 4th "/"  - lets call this "button_click" for above: replace {5} with 4 and replace url with button_click 2. Everything between the 6th and 7th "/" - lets call this "domain_ref" for above : replace {5} with 6 and replace url with domain_ref ... View more

This works! Thanks for the quick turnaround @inventsekar! ... View more

Can you show what you've tried.  Here's an example that shows how it can be done. If you select a time range > 30 days, then it shows one panel or < 30 days, the other one. <form> <label>Depends</label> <fieldset submitButton="false"> <input type="time" token="time_range"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table> <search> <done> <condition match="$result.x$==&quot;1&quot;"> <set token="show"></set> </condition> <condition match="$result.x$==&quot;0&quot;"> <unset token="show"></unset> </condition> </done> <query>| makeresults | eval earliest=relative_time(now(),$time_range.earliest|s$) | eval latest=if($time_range.latest|s$="now", now(), relative_time(now(),$time_range.latest|s$)) | eval diff=latest-earliest | eval x=if(diff &gt; (86400*30),1,0)</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel depends="$show$"> <table> <search> <query>| makeresults | eval Message="This panel is now showing because time range span is more than 30 days"</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="refresh.display">progressbar</option> </table> </panel> <panel rejects="$show$"> <table> <search> <query>| makeresults | eval Message="This panel is now showing because time range span is less than 30 days"</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> Hope this helps   ... View more

You can use both like and match functions with eval command to like(FIELD, PATTERN) This function returns TRUE if FIELD values matches the PATTERN. In PATTERN, you can use use the percent ( % ) symbol as a wildcard for multiple characters and use the underscore ( _ ) character for a single character match. match(FIELD, "REGEX") This is is regex based function and returns TRUE or FALSE based on whether REGEX matches FIELD values. So both queries below returns same results: | makeresults | eval printer ="Canon MF4770n (from WING_000.0.000.0-RCA)" | eval channel = if(match(printer, "WING.*RCA"), "Remote Print", "Office Print") . | makeresults | eval printer ="Canon MF4770n (from WING_000.0.000.0-RCA)" | eval channel = if(like(printer, "%WING%RCA%"), "Remote Print", "Office Print") ... View more

This worked, thank you so much! ... View more