@PickleRick well, I don't know if would call a set of ID's conditions. I was just trying to use those ID's as input. Kind of like a join. But now I know this is not possible  ... View more

@gcusello No I didn't, I thought this wasn't necessary because I use inputlookup and not lookup. I went through a lot of Splunk docs and questions but I can't find a answer. As far as I now understand is that lookup and inputlookup are two different things. By further evaluation I suspect that the max limit of 50000 is the problem. The outputlookup contains more then 100.000 results per day. I guess the number of results is just to much for Splunk to handle if you want to use results from another search in a new search  ... View more

@gcusello  ...I suspect I am doing somthing wrong? I thought if I create a outputlookup file I could use these results in a inputlookup ? ... View more

@ITWhisperer  when adding the Format the search keeps on the status 'parsing job'  ... View more

Yes ... View more

@gcusello I first created the outpoutlookup then I tried the inputlookup ... View more

@gcusello  I think its because of the asterix I use in the logger. I read that this is not supported in the evalfunction.... ... View more

@gcusello  , thanks the error is now gone. But I get no results which is strange. I am gonna try to look what is causing this. Maybe I should use 'transaction' because there are multiple kind of values for the logger not just the two I need the events that are in both  ... View more

Hi @gcusello , I tried yor suggestion but I get the error: Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr]).   My example search was simplified for several reasons, is there a chance I use illegal characters or something? ... View more

Yes, its either colon or a space. Your last reply worked. Thank you ... View more

@ITWhisperer  Thank you. I made a mistake with he examples  DocumentId 47335252  DocumentId:47337177  I changed your regex to :  | rex DocumentId:?(?<documentid>\d+) but then it does not recognize the first example (DocumentId:47337177 )  I wish I could understand regex more to fix it myself ... View more

@kamlesh_vaghela  Hi, sadly this does not make a difference. I suspect that it has something to do with the fact that splunk 'sees' the '0' in the single value as a result ... View more

Hi, I am not sure what is different in your suggestion.    I have this: <panel depends="$panel_show4$"> <title>Test</title> <single> <search> <progress> <condition match="'job.resultCount' &gt; 0"> <set token="panel_show4">true</set> </condition> <condition> <unset token="panel_show4"></unset> </condition> </progress> <query>My Search</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="rangeColors">["0x555","0xdc4e41"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> </single> </panel> ... View more

Hi, you are absolutely right but I find it difficult to supply samples. The situation is that there is a chain of events, every event starts with the logger "start" when the event cannot be distrtibuted it ends in an exception. Every event contains a messageid en sometimes a businessid. The messageid is unique for every string of events, this can be 2 events of 100. In case of an error there will be retries with the same messageid. I need the count of the unique id's that have been started en the count of the id's that had an exception. Both dedupped. Message.ID LOGGER LOGGER 1 “start” 2 “start” 3 “start” 3 "Exception" 3 "Exception" 4 "Start" 5 "Start" 5 "Exception" 6 "Start" 7 "Start" ... View more

Hi, what does 'category' do ? ... View more

Thanks, but I dont see how to encode something ... View more

I fixed it by replacing '| where ‘questions’ <1' with '| where ‘questions’ =0' Dont know why it didnt'work but now it does ... View more

@PavelP I fixed it by replacing '| where ‘questions’ <1' with '| where ‘questions’ =0' Dont know why it didnt'work but now it does ... View more