I have the following question regarding using the sendemail command together with the 'map' one. Using the below search I managed to send the data to respective recipients based on the results, however, when there are no results no email is being sent.   | inputlookup 'email_addresses + name.csv' | map [search index=test_index | search name="$name$" | fields name title attributes | stats count(eval(case(attribute="A", 1))) as "Attribute A" count(eval(case(attribute="B", 1))) as "Attribure B" count by name title _time | eval _time=strftime(_time, "%+") | appendpipe [stats count | where count=0 ] | sendemail bcc="$email_address$" subject="Table $name$ | _time" sendresults=true inline=true format=table   lookup contains two columns: email_address and name I tried different scenarios but using for example makeresults, appendpipe to insert dummy data in case no results are returned, but all caused a duplication of the email being sent, where the second email is missing the tokenization specified in the sendemail command. ... View more

I have the following case: I have 3 different indexes (A, B and C). My goal is to find what percentage of the devices found in index B could also be found in index C. In index A I have fields asset_name and mac_address (~1000 different devices) In index B I have field src_mac (~150 different devices) In index C I have field asset_name (~6000) different devices Basically, I firstly try to find the asset names of all 150 hosts from index B by looking into index A. And then I compare the newly found asset names to the asset names of index C. index="C" | stats count by asset_name | join type=left [search (index=A OR index=B) | eval all_macAddresses = coalesce(src_mac, mac_address) | stats values(asset_name) as asset_name values(src_mac) as src_mac values(mac_address) as mac_address by all_macAddresses | eval match = if(src_mac == mac_address, "match", "no_match") | where match="match" | table asset_name all_macAddresses] | eval new=if(isnull(all_macAddresses,"NOT_OK","OK") | stats count by new I managed to get the results by using the above search but I was wondering whether this could be achieved without using any subsearches. ... View more