index=my_index [search is here]  | outputcsv mycsv.csv After saving the search results into mycsv.csv file,  can I access the file via search head? | inputlookup mycsv.csv   -- is not working      ... View more

Hey Splunkers,   I have the following search but it is not working as expected. What I am trying to achieve is if one of the conditions matches I will table out some fields. condition 1 : if user_action="Update*" OR  Condition 2:  within each 5 min bucket, if any user has access more than 400 destination in the same index, index1 but it doesn't work. How can I check both condition on the same search?  Thanks in advanced!     index=index1 ``` condition 1 ``` ( user_action="Update*" ) OR ``` condition 2 ``` ( [search index=index1 NOT user IN ("system*", "nobody*") | bin _time span=5m | stats values(dest) count by _time, user | where count > 400 ] ) | table _time, user, dest       ... View more

I have two indexes which include same data in a different fields as seen below.  index1 -- user, fileName, ...etc index2 -- event.file, actor user = actor and fileName = event.file The following search gives me if a user and their file in index2 is available in the index1, but I dont need this since I know they should be included in index1 What I am trying to find is : If a user and their file in index2 is NOT available in the index1, I wanna list them out.  Thanks for help index="index1" [search index="index2" "event"=event2 event.file="something_*" | table event.file, actor | rename event.file as fileName, actor as user ] | table actor ... View more

Hi, Need help to get following results from the search.  all helps will be appreciated.  On the image below, same colors show match cases I would like to get out of my search. Here is the condition I am looking for: Under the same pid which is all same already on image below.  example -1 ( green on the image) : pid_of_curl = 990820 pid_of_sh = 990821 If exe = curl and ( pid_of_curl + 1 ) has exe = sh exe is curl and  990820 + 1 = 990821 = pid in which exe = sh if exe is either "curl" or "wget" and its pid +1 is equal to ( bash or sh ) pid ... View more