Thanks for your suggestion. I read your the link you provided. So, I can't outputlookup data to KVStore without building KVcollection first, correct? Should I create transform.conf and collection.conf? I don't have admin right.   search data | outputlookup kv_store_lookup   https://docs.splunk.com/Documentation/Splunk/9.2.1/Knowledge/ConfigureKVstorelookups https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Outputlookup ... View more

Hi, Thank you for your suggestion. When I use a scheduled report, and see the recent search, Splunk appends "| summaryindex" at the end of the search, not "collect" command.   So, I thought "collect" always refers to "manual" push versus "summary index" in a scheduled report.  My understanding you have 2 scheduled reports. Is the following accurate? 1)  roll forward existing data (from and to the same summary index - say index A)  2) push new data (from a different index to summary index - say from index X to index A) In my case, the data from DBXquery is always get re-write, so I only need the latest data, but I may use your method in the future. Thanks for this. Based on the link that you sent and the following post, it looks like I still need the CSV file. (See below it does inputlookup to CSV first, then outputlookup to KV) Is this correct?    My goal is to avoid having CSV file since there's a limit in size   https://community.splunk.com/t5/Getting-Data-In/How-to-transfer-existing-CSV-data-to-kvstore/m-p/144641 | inputlookup filename.csv | outputlookup lookup_name Thank you again. ... View more

Hi So far, I didn't see any missing data, so it's not causing a problem, except for the error message. I am not sure why Splunk has to throw the error message.  Thank you for your help. ... View more

Hi, I am not sure the purpose of roll forward existing index. How do I use "collect" to write data in a scheduled report?  My understanding collect is a manual push. I am looking for automatic update daily. Where does KV store lookup save the data?  How do I move the DBXquery to KV store?  Does it require "admin"? What do you think about the "append command" in the previous post? Thank you so much for your help. ... View more

Hi, What I meant by splitting the data is to split the number of rows. So, if my query has 200k rows, splitting into 2, it becomes 100k rows. Or @marnall suggested split into a smaller queries..  not sure if it's possible since I have a large query involving multiple DBs I don't know how to do this in a scheduled report and write it into the same summary index with the same _time setting.  Please suggest. Thanks ... View more

Hi, Thanks for your help. No I do not care the order. I am afraid if I split the data and re-combine them it will return duplicate/missing data as it doesn't have a unique identifier. Also I don't know how to split the data and keeping the same _time.  Please help answer this. Thanks How do I split my query from DBXquery (eg. 200k rows)and push it into a Summary Index at the same time? ... View more

Hello, Thank you again for your help. Just to clarify,  I cannot set _time to the exact time every time I query the data, , correct? So, I need to filter the data last update, if I want to get the most recent copy. I currently are using CSV as a lookup, but the limitation is the size like you mentioned. I am trying to replace CSV lookup by doing the following:   Please let me know what you think. https://community.splunk.com/t5/Splunk-Search/How-to-perform-lookup-from-index-search-with-dbxquery/m-p/650654 | index=vulnerability_index | table ip_address, vulnerability, score | append [| dbxquery query="select * from tableCompany"] | stats values(*) as * by ip_address ... View more

How do I split my query from DBXquery (eg. 200k rows)and push it into a Summary Index at the same time? | dbxquery query=" SELECT * from Table_Test" the scheduled report for summary index will add something like this: summaryindex  spool=t  uselb=t  addtime=t  index="summary" file="test_file" name="test" marker="hostname=\"https://testcom/\",report=\"test\"" Technically, I don't really need the _time because it is a static data, but it needs to get updated every day. Thanks ... View more

Hello @gcusello  Sorry.. I tried again your last suggestion, but num and num2 still have type as "Number" I expect num2 has "String" type after using   num2= tostring(num,"commas")   Please suggest   Thanks again..   ... View more

@gcusello  Yes but why the first one is also string? The first one is number. Should I remove " " from typeof?        Thanks | makeresults | eval num = 1 | eval var_type = typeof(num) | eval num2 = tostring("num") | eval var_type2 = typeof(num2)   Thanks ... View more

They both became String.     Num should be number.  Thanks   ... View more

Hello @gcusello , I tried and the same result..  see below..  thank you   ... View more

Hello, Here's the image. I want to have the time range change based on the selected Grade. For example: If I select Kindergarten, the time will change to "last 24 hours" Thank you ... View more

Thanks for your suggestion I tried to simplify, but this is what I am trying to solve: https://community.splunk.com/t5/Splunk-Search/How-to-search-based-on-drop-down-condition/m-p/681366#M232829 ... View more

Hello, I need to filter using search based on a condition instead of  | search no = "abc"         I need to make  "abc" as a variable Thanks, Marius ... View more

Hello, Thank you so much for your response. The query that contain the search is actually in the statistic table, but the condition is a condition based on the drop down token. This is the main question: How to dynamically search / where based on variable like below? | search day_no_each_timestamp = day_in_week OR | where day_no_each_timestamp = day_in_week   ... View more

Hello,  So, is multivalue the only way to use list/array? If I want to assign 7 values, should I use mvappend 7 times like the following? | eval test = mvappend("0", test) | eval test = mvappend("1", test) | eval test = mvappend("2", test) | eval test = mvappend("3", test) | eval test = mvappend("4", test) | eval test = mvappend("5", test) | eval test = mvappend("6", test) How do I get true/false return if I want to see if number 5 is in the array/list?   MVfind only give me the position of 5, which is 1. | eval n = mvfind(test, "5") Thank you ... View more

Hi @marnall  Thank you again for your help  I did some test, it appears that if we include _time in   | table,   _time within  _raw will follow the _time field, but if we use | table without _time, the _time will be set to info_min_time This is also the reason why it didn't work when I tried your first suggestion. Can you try the following and let me know the result?    Thank you so much index=_internal | table sourcetype | head 5 | eval othertestfield="test2" | collect index=summary testmode=true addtime=true   ... View more