Hello, I want to run a datamodel tstats search, excluding some events with a lookup for src_ip's. In case I fill the lookup with a ipv6 subnet, the search breaks with Error in 'TsidxStats': WHERE clause is not an exact query. My query in a simple way: ------------------------- | tstats summariesonly=t allow_old_summaries=t values(sourcetype) as sourcetype count AS eventCount max(_time) as maxtime min(_time) as mintime from datamodel=Intrusion_Detection where (nodename = IDS_Attacks) NOT [ | inputlookup ip_test.csv | fields src ] groupby IDS_Attacks.src, IDS_Attacks.dest, IDS_Attacks.signature, IDS_Attacks.action ------------------------ lookup ip_test.csv: comment,src ipv4 net,10.20.30.0/24 ipv4,10.20.30.43 ipv6,1a00:2a60:3000:1:1:43 ipv6 net,1a00:2a60:3000:1::/64   With deleting the "ipv6 net" entry the search is running. ... View more

Hi, I have a variety of CSV lookup tables and have to add a field to each of these tables. The CSV files are used by scheduled searches, so I need their contents AND the field names. table1.csv: index,sourcetype index1,st1 table2.csv: sourcetype,source st1,source1 table3.csv: field1,field2 - no rows For this, I use the following spl: | inputlookup table1.csv | table index,sourcetype,comment1 | outputlookup table1.csv | inputlookup table2.csv | table sourcetype,source,comment2 | outputlookup table2.csv | inputlookup table3.csv | table field1,field2,comment3 | outputlookup table3.csv For table1 and table2, this works. But for table3, I have the problem that outputlookup creates an empty table and the field names are missing. Is there a search that can extend empty and filled lookups?   Thank you. ... View more