Hi @fishn  To match the partial string in the lookup (e.g. poda) with the data (e.g. "poda-284489-cs834"), you need to append each of the pod_name_lookup values with a wildcard asterisk, i.e. poda*, podb*, podc* Then, add a lookup definition with the following setting, under the Advanced options checkbox: Then in your search: (where lkp_pod_name is your lookup definition)   | lookup lkp_pod_name pod_name_lookup as pod_name    --- Next, to show which pods are missing and their importance, you can do it like this: index=abc sourcetype=kubectl | eval Observed=1 | append [| inputlookup lkp_pod_name | eval Observed=0 ] | lookup lkp_pod_name pod_name_lookup as pod_name OUTPUT pod_name_lookup | stats max(Observed) as Observed by pod_name_lookup, importance | where Observed=0  --- Finally, to count how many critical and non-critical pods are not found as well as table the list of missing pods, you can append this line to the above search: | eventstats count as count_by_importance by importance   ... View more

Yes, you can. As per the documentation, there are no prerequisites for the ITSI admin exam: https://www.splunk.com/en_us/training/certification-track/splunk-itsi-certified-admin.html ... View more

Hi @dongwonn a few things to check -check the host field in Splunk matches the host:: stanza in your props.conf -Since you are not explicitly specifying a lot of configs, they may be taking default values from other places. Use btool to check the full props settings being applied to this host: $SPLUNK_HOME/bin/splunk cmd btool props list host::x.x.x.21 -Update your TIME_PREFIX to capture the full string before the timestamp beginning at the start of the event, so that Splunk will definitely exclude the preceding timestamps. Example: TIME_PREFIX=^\w{3}\s\d\d\s(\d{2}\:?){3}\s(\d{0,3}\.?){4}\s\w{3}\s\d\d\s(\d{2}\:?){3}\s[\w\s]+\-:\s\[   ... View more