Thank you very much!!!! ... View more

Hi there, Eval Query for Limited Use: While eval queries can modify certain fields, unfortunately, deleting or closing notable events directly isn't possible with them. API Offers More Power: The Splunk Search API is your best bet for bulk actions like closing or deleting events. You can leverage the delete or set endpoints to achieve your goal. Filtering Still an Option: If using the API feels daunting, consider refining your dashboard/report queries to exclude events before the specific date. Filtering might be less efficient for massive datasets, but it's a reliable route. Remember: Deleting is permanent, closing retains some data. Choose wisely! Test your approach on a small sample before applying to all events. Consult Splunk documentation for detailed API usage: <invalid URL removed> ~ If the reply helps, a Karma upvote would be appreciated ... View more

Hi @gbam, Splunk provides an eval function, json_array_to_mv, to convert JSON-like array values to multivalued field values. After conversion, you can use the lookup command just as you would for any other field: | makeresults | eval id="[\"123\", \"321\", \"456\"]" | eval id=json_array_to_mv(id, false()) | lookup gbam_lookup.csv id _time id x y 2023-11-10 16:14:53 123 321 456 Data Data Data3 Data2 Data2 Data3   Index 0 of multivalued field id corresponds to index 0 of multivalued fields x and y, index 1 corresponds to index 1, etc. ... View more