I'm creating a dashboard to easily search through our web proxy logs and table out the results when troubleshooting. The issue is that sometimes the logs don't contain a destination IP, sometimes they do. For the dashboard fields that you can input, one of them I want to be able to specify sometimes is the destination IP (field: dest_ip), however, the field doesn't always exist so if I use the following search (I'm excluding the tabling): index=proxy c_ip=$cip$ cs_host=$cshost$ action=$action$ dest_ip=$destip$ Dashboard values: c_ip=1.2.3.4 cs_host=* (default) action=* (default) dest_ip=* (default) It will exclude some of the logs since they don't all have the field "dest_ip" The other 3 fields exist in all logs.  In the dashboard you can input values for each of the fields.  I'm trying to allow that for dest_ip but it doesn't always exist - that's the issue I'm trying to overcome. ... View more

I am looking to run a search and filter out whitelisted exceptions in a lookup file.  2 of the fields could contain multiple values though. Here's the search I'm using:   index=microsoft365 sourcetype IN (azure:aad:signin, o365:management:activity) (action=success OR status=success) NOT Operation=UserLoginFailed | eval user_id=lower(user_id) | dedup src user_id date_month | iplocation src | search NOT Country IN ("United States", "Canada") | lookup local=t asn ip AS src | lookup nonUSlogins.csv ca.user_id AS user_id OUTPUT a.country a.ticket a.user_id | table user_id src date_month Country Region City asn autonomous_system a.user_id a.country     I tried using a match but found you can't use match if there are multiple values in a single field. Here is an example result currently: user_id src  date_month Country Region City asn autonomous_system a.user_id a.country user1 1.1.1.1 june Albania Tirana District Tirana     user1 user1 Albania Canada user1 2.2.2.2 june Germany Land Berlin Berlin     user1 user1 Albania Canada   I'm trying to eliminate results where the value for user_id matches a.user_id (values in this filed will be the same when there are multiple) AND the value of Country matches one of the countries listed in a.country   I would expect to see this in the end: user_id src  date_month Country Region City asn autonomous_system a.user_id a.country user1 2.2.2.2 june Germany Land Berlin Berlin     user1 user1 Albania Canada   ... View more