@bowesmana is correct.  mvfind won't accept two variables.  Also as he says, single quote should be used to represent value in where command.  This is an alternative solution:   ``` the above emulates index="okta" actor.alternateId=*@* authenticationContext.externalSessionId!="unknown" | eval "ASN"='securityContext.asNumber' | eval "Session ID"='authenticationContext.externalSessionId' | eval "User"='actor.alternateId' | eval "Risk"='debugContext.debugData.risk' | stats dc("user_agent") as "Agent Count" values(user_agent) AS "User Agent" dc(ASN) as "ASN Count" values(ASN) as ASN dc(Risk) as "Risk Count" values(Risk) as Risk by User "Session ID" | table "Session ID", ASN, "ASN Count", "User Agent", "Agent Count", User, Risk | lookup asn_user.csv User output ASN as ASNfound | where 'ASN Count' > 1 AND 'Agent Count' > 1 AND mvmap(ASN, if(ASN == ASNfound, "yes", "no")) == "no"   Here is an emulation of your illustrated data after lookup:   | makeresults format=csv data="Session ID, ASN, ASN Count, User Agent, Agent Count, User, Risk, ASNfound idxxxxxxxxxxxx ,\"12345 321\",2 ,\"UserAgent1 UserAgent2\",2, user@company.com, \"{reasons=Anomalous Device, level=MEDIUM}\", \"12345 321\" idxxxxxxxxxxxx, \"6789 321\",2, \"UserAgent1 UserAgent2\",2, user@company.com, \"{reasons=Anomalous Device, level=MEDIUM}\", \"12345 321\"" ``` the above emulates index="okta" actor.alternateId=*@* authenticationContext.externalSessionId!="unknown" | eval "ASN"='securityContext.asNumber' | eval "Session ID"='authenticationContext.externalSessionId' | eval "User"='actor.alternateId' | eval "Risk"='debugContext.debugData.risk' | stats dc("user_agent") as "Agent Count" values(user_agent) AS "User Agent" dc(ASN) as "ASN Count" values(ASN) as ASN dc(Risk) as "Risk Count" values(Risk) as Risk by User "Session ID" | table "Session ID", ASN, "ASN Count", "User Agent", "Agent Count", User, Risk | lookup asn_user.csv User output ASN as ASNfound ``` | where 'ASN Count' > 1 AND 'Agent Count' > 1 AND mvmap(ASN, if(ASN == ASNfound, "yes", "no")) == "no"   (The above uses a side effect of SPL's equality operator.) It gives ASN ASN Count ASNfound Agent Count Risk Session ID User User Agent 6789 321 2 12345 321 2 {reasons=Anomalous Device, level=MEDIUM} idxxxxxxxxxxxx user@company.com UserAgent1 UserAgent2 Play with it and compare with real data. ... View more

If you forwarder is not forwarding the complete file, there might be a problem with linebreaker.  This has nothing to do with how to search.  Getting Data In is a better forum. ... View more

Assuming you have lookup file asn_user.csv and you set up a lookup called asn_user.csv (my preference is to not use .csv in lookup name, but many others do not make the distinction), you can do index="okta" actor.alternateId=*@* authenticationContext.externalSessionId!="unknown" | eval "ASN"='securityContext.asNumber' | eval "Session ID"='authenticationContext.externalSessionId' | eval "User"='actor.alternateId' | eval "Risk"='debugContext.debugData.risk' | stats dc("user_agent") as "Agent Count" values(user_agent) AS "User Agent" dc(ASN) as "ASN Count" values(ASN) as ASN dc(Risk) as "Risk Count" values(Risk) as Risk by User "Session ID" | table "Session ID", ASN, "ASN Count", "User Agent", "Agent Count", User, Risk | lookup asn_user.csv User output ASN as ASNfound | where "ASN Count" > 1 AND "Agent Count" > 1 AND NOT mvfind(ASNfound, ASN)   ... View more

An easier, and perhaps more semantic method is to use JSON functions introduced in 8.1 to restructure data. (As we have seen before, you have developers who overload JSON's key name to convey data, which is never a good thing.  If you have any influence on them, maybe ask them to change structure before it reaches data consumer.) With the data you illustrated, Splunk would have given you fields like key1.field1, key2.field2.  Iterate over them using foreach.   | foreach *.* [eval temp = json_object(), temp = json_set(temp, "Name A", "<<MATCHSEG1>>", "Name B", "<<MATCHSEG2>>", "Value", '<<FIELD>>'), reformat = mvappend(reformat, temp)] | mvexpand reformat | spath input=reformat | fields - _* key* temp    Your example results in Name A Name B Value reformat key1 field1 x {"Name A":"key1","Name B":"field1","Value":"x"} key2 field2 xx {"Name A":"key2","Name B":"field2","Value":"xx"} key3 field3 xxx {"Name A":"key3","Name B":"field3","Value":"xxx"} Here is an emulation you can play with and compare with real data   | makeresults | eval _raw="{ \"key1\": { \"field1\": \"x\" }, \"key2\": { \"field2\": \"xx\" }, \"key3\": { \"field3\": \"xxx\" } }" | spath ``` data emulation above ```   ... View more

The "message" node in the event is an Apache HTTPD access log.  So, apply Splunk's built-in access-extraction to it. ("message" should have been extracted by Splunk already.)     | rename message as _raw | extract access-extractions | timechart span=1month sum(bytes) as total_traffic     Your sample will give total_traffic 46989 Here is an emulation using the sample you give, corrected for JSON completion:     | makeresults | eval _raw = "{\"time\":\"2024-07-18T09:29:59.900525659-05:00\",\"stream\":\"stdout\",\"logtag\":\"F\",\"message\":\"10.42.11.59 - - [18/Jul/2024:14:29:59 +0000] \\\"POST / HTTP/1.1\\\" 200 46989 \\\"-\\\" \\\"Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.17628; Pro)\\\"\",\"kubernetes\":{\"pod_name\":\"apache-4\",\"namespace_name\":\"some name\"}" | spath | eval _time = strptime(time, "%FT%T.%9N%z") ``` data emulation ```     Play with it and compare with real data ... View more

Make your selector token "24hour", "7day", etc. Let's call it $span_tok$. This should do. index=myindex earliest=-$span_tok$-$span_tok$ | timechart span=$span_tok$ count | streamstats delta(count) as pct_change | eval pct_change = pct_change / (count - pct_change) * 100 The idea is simple, look back 2x $span_tok$, then calculate delta on the go.  ... View more

Like @P_vandereerden says, SPL is totally different from procedural languages.  You need to think differently.  One point is: explicit iteration should be used sparsely.  There are also lots of other elements in the illustrated code that make it "unSPL" and some unnecessary. For a problem like this, it is better to follow my four golden rules ("four commandments") of asking answerable questions. To ask an answerable data analytics question, follow these golden rules; nay, call them the four commandments: Illustrate data input (in raw text, anonymize as needed), whether they are raw events or output from a search that volunteers here do not have to look at. Illustrate the desired output from illustrated data. Explain the logic between illustrated data and desired output without SPL. If you also illustrate attempted SPL, illustrate actual output and compare with desired output, explain why they look different to you if that is not painfully obvious. In your case, you also want to illustrate how desired output change when the token takes different values.  One more tip: Use Splunk's auto format feature to format SPL if there are more than a couple pipes.  Like this: index="xxx" source = "yyyyzzz" AND $DropdownValue$ AND Input | eventstats max(_time) as maxTimestamp by desc | head 1 | dedup _time | eval lastTriggered = strftime(_time, "%d/%m/%Y %H:%M:%S %Z") | stats values(lastTriggered) as lastTriggeredTime | appendcols [search index="xxx" source = "yyyyzzz" sourcetype = "mule:rtf:per:logs" AND $DropdownValue$ AND Output | eventstats max(_time) as maxTimestamp by desc | head 1 | dedup _time | eval lastProcessed = strftime(_time, "%d/%m/%Y %H:%M:%S %Z") | stats values(lastProcessed) as lastProcessedTime] | appendcols [search index="xxx" source = "yyyyzzz" sourcetype = "mule:rtf:per:logs" AND $DropdownValue$ AND Error | eventstats max(_time) as maxTimestamp by desc | head 1 | dedup_time | eval lastErrored = strftime(_time, "%d/%m/%Y %H:%M:%S %Z")] | eval "COMPONENT ID"="$DropdownValue$" | eval "Last Triggered Time"=lastTriggeredTime | eval "Last Processed Time"=lastProcessedTime | eval "Last Errored Time"=lastErrored | table "COMPONENT ID", "Last Triggered Time", "Last Processed Time","Last Errored Time" | fillnull value="NOT IN LAST 12 HOURS" "COMPONENT ID","Last Triggered Time", "Last Processed Time","Last Errored Time" After this formating, you can easily see why some commands are wasteful. ... View more

The fragment you illustrated is NOT a complete XML document.  Please post full event.  My suspicion is that your raw event contains an XML document, but also contains something that is not XML.  You will need to first extract XML into a field, then apply spath. ... View more

This is a Splunk forum.  No one here knows what your data source looks like. To ask an answerable data analytics question, follow these golden rules; nay, call them the four commandments: Illustrate data input (in raw text, anonymize as needed), whether they are raw events or output from a search that volunteers here do not have to look at. Illustrate the desired output from illustrated data. Explain the logic between illustrated data and desired output without SPL. If you also illustrate attempted SPL, illustrate actual output and compare with desired output, explain why they look different to you if that is not painfully obvious. ... View more

Please illustrate full message.  The look of the fragment suggest your source is actually JSON, something like   {"message":"journey::cook_client: fan: 0, auger: 0, glow_v: 36, glow: false, fuel: 0, cavity_temp: 257", "foo":"bar"}   Is this correct?  Using regex directly on structured data is strongly discouraged as any regex is doomed to be fragile. If the JSON is raw event, Splunk would have already extracted a field called "message".  Start from this field instead.  This field also is structured as KV pairs.  Use kv aka extract instead of regex.   | rename _raw as temp, message as _raw | kv kvdelim=": " pairdelim="," | rename _raw as message, temp as _raw | fields fuel   Your sample data would have given fuel _raw _time 0 {"message":"journey::cook_client: fan: 0, auger: 0, glow_v: 36, glow: false, fuel: 0, cavity_temp: 257", "foo":"bar"} 2024-07-17 09:06:35 Here is an emulation for you to play with and compare with real data   | makeresults | eval _raw = "{\"message\":\"journey::cook_client: fan: 0, auger: 0, glow_v: 36, glow: false, fuel: 0, cavity_temp: 257\", \"foo\":\"bar\"}" | spath ``` data emulation above ```     ... View more

serial_number would have already been extracted, too.  You do whatever is needed.  But I do not see a chart of two values() function useful in this case.  Maybe you mean to have something like _time E21 E25 2024-07-15 51A81FC 51A86FC   2024-07-16   51A81FC In other words, get serial_numbers according to error_code?  All you need is something like   <your search> "ErrorCode(*)" | rex field=message "ErrorCode\((?<error_code>[^\)]+)" | timechart span=1d values(serial_number) by error_code   Here, I propose that you restrict events to those containing error code in index search rather than in another search line. Or, if you want to group error_codes on individual serial_number, like _time 51A81FC 51A86FC 2024-07-15 E21 E21 2024-07-16 E25   For this, do   <your search> "ErrorCode(*)" | rex field=message "ErrorCode\((?<error_code>[^\)]+)" | timechart span=1d values(error_code) by serial_number   Does this make sense? Here is an emulation to get the above results.  Play with it and compare with real data   | makeresults | eval data = mvappend("{\"time\": \"2024-07-15\", \"message\":\"gimlet::hardware_controller: State { target: Idle, state: Idle, cavity: 42400, fuel: 0, shutdown: None, errors: ErrorCode(E21)}\", \"serial_number\": \"51A86FC\"}", "{\"time\": \"2024-07-15\", \"message\":\"gimlet::hardware_controller: State { target: Idle, state: Idle, cavity: 42400, fuel: 0, shutdown: None, errors: ErrorCode(E21)}\", \"serial_number\": \"51A81FC\"}", "{\"time\": \"2024-07-16\", \"message\":\"gimlet::someotherstuff: State { target: whatever, state: whaever, some other messages, errors: ErrorCode(E25)}\", \"serial_number\": \"51A81FC\"}") | mvexpand data | rename data as _raw | spath | eval _time = strptime(time, "%F") ``` the above emulates <your search> "ErrorCode(*)" ```   ... View more

Thank you for sharing complete event.  If this is raw event, all you need is spath (or xmlkv, which has some interesting restrictions).  For example,   <your search> | spath   These commands are QA tested by Splunk, much more robust than anything you can develop. (It also has the added benefit of getting richer data extracted.) Here is a complete emulation.  Play with it and compare with real data.   | makeresults | eval _raw = "</HostProperties><ReportItem severity=\"0\" port=\"0\" pluginFamily=\"Ubuntu Local Security Checks\" pluginName=\"Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS : Vim vulnerabilities (USN-6420-1)\" pluginID=\"182769\" protocol=\"tcp\" <cvss_vector>AV:N/AC:L/Au:N/C:C/I:C/A:C</cvss_vector><description>The remote Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6420-1 advisory. - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483. (CVE-2022-3234) - Use After Free in GitHub repository vim/vim prior to 9.0.0490. (CVE-2022-3235) - Use After Free in GitHub repository vim/vim prior to 9.0.0530. (CVE-2022-3256) - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552. (CVE-2022-3278) - Use After Free in GitHub repository vim/vim prior to 9.0.0579. (CVE-2022-3297) - Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. (CVE-2022-3324) - Use After Free in GitHub repository vim/vim prior to 9.0.0614. (CVE-2022-3352) - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742. (CVE-2022-3491) - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. (CVE-2022-3520) - Use After Free in GitHub repository vim/vim prior to 9.0.0789. (CVE-2022-3591) - A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upgrading to version 9.0.0805 is able to address this issue. The name of the patch is. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-212324. (CVE-2022-3705) - Use After Free in GitHub repository vim/vim prior to 9.0.0882. (CVE-2022-4292) - Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. (CVE-2022-4293) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.</description><synopsis>The remote Ubuntu host is missing one or more security updates.<plugin_output> - Installed package : vim_2:8.1.2269-1ubuntu5.17 - Fixed package : vim_2:8.1.2269-1ubuntu5.18 - Installed package : vim-common_2:8.1.2269-1ubuntu5.17 - Fixed package : vim-common_2:8.1.2269-1ubuntu5.18 - Installed package : vim-runtime_2:8.1.2269-1ubuntu5.17 - Fixed package : vim-runtime_2:8.1.2269-1ubuntu5.18 - Installed package : vim-tiny_2:8.1.2269-1ubuntu5.17 - Fixed package : vim-tiny_2:8.1.2269-1ubuntu5.18 - Installed package : xxd_2:8.1.2269-1ubuntu5.17 - Fixed package : xxd_2:8.1.2269-1ubuntu5.18 </plugin_output></ReportItem><ReportItem severity=\"0\" port=\"0\" pluginFamily=\"Ubuntu Local Security Checks\" pluginName=\"Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : LibTIFF vulnerability (USN-6428-1)\" pluginID=\"182891\" protocol=\"tcp\" <description>The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6428-1 advisory. - A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x. (CVE-2023-1916) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.</description><synopsis>The remote Ubuntu host is missing a security update.</synopsis><cve>CVE-2023-1916</cve><xref>USN:6428-1</xref><see_also>https://ubuntu.com/security/notices/USN-6428-1</see_also><risk_factor>Medium</risk_factor><script_version>1.0</script_version><plugin_output> - Installed package : libtiff5_4.1.0+git191117-2ubuntu0.20.04.9 - Fixed package : libtiff5_4.1.0+git191117-2ubuntu0.20.04.10 </plugin_output></ReportItem><ReportItem severity=\"3\" port=\"0\" pluginFamily=\"Ubuntu Local Security Checks\" pluginName=\"Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : GIFLIB vulnerabilities (USN-6824-1)\" pluginID=\"200257\" protocol=\"tcp\"<description>The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6824-1 advisory.</plugin_output></ReportItem>" ``` data emulation above ``` | spath | fields plugin_output   This is the output (for brevity, I discarded all other nodes in XML): plugin_output _raw _time - Installed package : libtiff5_4.1.0+git191117-2ubuntu0.20.04.9 - Fixed package : libtiff5_4.1.0+git191117-2ubuntu0.20.04.10 </HostProperties><ReportItem severity="0" port="0" pluginFamily="Ubuntu Local Security Checks" pluginName="Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS : Vim vulnerabilities (USN-6420-1)" pluginID="182769" protocol="tcp" <cvss_vector>AV:N/AC:L/Au:N/C:C/I:C/A:C</cvss_vector><description>The remote Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6420-1 advisory. - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483. (CVE-2022-3234) - Use After Free in GitHub repository vim/vim prior to 9.0.0490. (CVE-2022-3235) - Use After Free in GitHub repository vim/vim prior to 9.0.0530. (CVE-2022-3256) - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552. (CVE-2022-3278) - Use After Free in GitHub repository vim/vim prior to 9.0.0579. (CVE-2022-3297) - Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. (CVE-2022-3324) - Use After Free in GitHub repository vim/vim prior to 9.0.0614. (CVE-2022-3352) - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742. (CVE-2022-3491) - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. (CVE-2022-3520) - Use After Free in GitHub repository vim/vim prior to 9.0.0789. (CVE-2022-3591) - A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upgrading to version 9.0.0805 is able to address this issue. The name of the patch is. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-212324. (CVE-2022-3705) - Use After Free in GitHub repository vim/vim prior to 9.0.0882. (CVE-2022-4292) - Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. (CVE-2022-4293) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.</description><synopsis>The remote Ubuntu host is missing one or more security updates.<plugin_output> - Installed package : vim_2:8.1.2269-1ubuntu5.17 - Fixed package : vim_2:8.1.2269-1ubuntu5.18 - Installed package : vim-common_2:8.1.2269-1ubuntu5.17 - Fixed package : vim-common_2:8.1.2269-1ubuntu5.18 - Installed package : vim-runtime_2:8.1.2269-1ubuntu5.17 - Fixed package : vim-runtime_2:8.1.2269-1ubuntu5.18 - Installed package : vim-tiny_2:8.1.2269-1ubuntu5.17 - Fixed package : vim-tiny_2:8.1.2269-1ubuntu5.18 - Installed package : xxd_2:8.1.2269-1ubuntu5.17 - Fixed package : xxd_2:8.1.2269-1ubuntu5.18 </plugin_output></ReportItem><ReportItem severity="0" port="0" pluginFamily="Ubuntu Local Security Checks" pluginName="Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : LibTIFF vulnerability (USN-6428-1)" pluginID="182891" protocol="tcp" <description>The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6428-1 advisory. - A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x. (CVE-2023-1916) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.</description><synopsis>The remote Ubuntu host is missing a security update.</synopsis><cve>CVE-2023-1916</cve><xref>USN:6428-1</xref><see_also>https://ubuntu.com/security/notices/USN-6428-1</see_also><risk_factor>Medium</risk_factor><script_version>1.0</script_version><plugin_output> - Installed package : libtiff5_4.1.0+git191117-2ubuntu0.20.04.9 - Fixed package : libtiff5_4.1.0+git191117-2ubuntu0.20.04.10 </plugin_output></ReportItem><ReportItem severity="3" port="0" pluginFamily="Ubuntu Local Security Checks" pluginName="Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : GIFLIB vulnerabilities (USN-6824-1)" pluginID="200257" protocol="tcp"<description>The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6824-1 advisory.</plugin_output></ReportItem> 2024-07-16 14:52:11 ... View more

The answer can depend on data characteristics.  On first look, I thought your solution was as efficient as it can get.  You reduced a large dataset (billions of events) to a much smaller dataset, i.e., distinct values of "Field B" grouped by distinct values of "Field A".  Can you give a comparison of scale of these two datasets? (I.e., how many rows after stats before where, compared to how many raw events.) A bigger problem is in problem statement.  There seems to be a misstatement in the description: table my search result needs to only return Value B; Values A and C will be thrown out, because they don't have a unique value in Field B. I believe you meant to say "because they don't correspond to a unique value in Field A," not Field B because every value in "Field B" is unique in your illustration.  Is every value in "FieldB" unique in real data?  Your SPL seems to imply so. Because otherwise mvcount(Field B)=1 can pick more than those corresponding to a unique "Field A".  For example, if dataset is Field A Field B Value A Value A1 Value A Value A1 Value B Value B1 Value C Value C1 Value C Value C2 Value C Value C3 your search will pick two data points Field A Field B Value A Value A1 Value B Value B1 But "Value A" is not unique in original data. (Neither is "Value A1".)  Can you clarify? ... View more

Your illustrated fragment suggests that your raw events are either XML or contains XML documents.  I strongly discourage treating structured data such as XML as plain text.  Please post complete sample event. (Anonymize as needed.) ... View more

Alternatively, if you already have all possible paths and there are not too many, coalesce can be more succinct.  For the two path illustrated, | eval id = coalesce('response.resources.id', 'respones.actors.id') ... View more

First, thank you for illustrating data, and explain your requirement clearly.  Second, the illustration appears to be a fragment of a valid JSON object.  Is this correct?  Is the "message" key a top node in raw event?  Splunk should have given you a field "message" with the following value (no special instruction required): message gimlet::hardware_controller: State { target: Idle, state: Idle, cavity: 42400, fuel: 0, shutdown: None, errors: ErrorCode(E21)} Is this correct? Your problem is a simple one, but illustrating data correctly will save you lots of trouble in the future. Provided that top-node "message" field exists, all you need to do is   | rex field=message "ErrorCode\((?<error_code>[^\)]+)"   This is an emulation of a raw event that would give you that message field without instruction   | makeresults | eval _raw = "{\"message\":\"gimlet::hardware_controller: State { target: Idle, state: Idle, cavity: 42400, fuel: 0, shutdown: None, errors: ErrorCode(E21)}\"}" | spath ``` data emulation above ```   Play with it and compare with real data.  Output using this emulation is _time _raw error_code message 2024-07-15 15:05:20 {"message":"gimlet::hardware_controller: State { target: Idle, state: Idle, cavity: 42400, fuel: 0, shutdown: None, errors: ErrorCode(E21)}"} E21 gimlet::hardware_controller: State { target: Idle, state: Idle, cavity: 42400, fuel: 0, shutdown: None, errors: ErrorCode(E21)}   Hope this helps ... View more

Thank you for sharing text raw events.  I plugged your new text into emulation.  Still get the correct results.  Can you run the emulation and compare with real data?   | makeresults | eval data=mvappend("[{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00031AdjPro\",\"TOTAL\":0,\"PROCESSED\":1,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00031AdjPro\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2118,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00035\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00035Med\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00052Med\",\"TOTAL\":0,\"PROCESSED\":2898,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00052Med\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":3,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00075\",\"TOTAL\":0,\"PROCESSED\":94,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00075\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":2,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00075\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":59,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00119\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":3,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00201H\",\"TOTAL\":0,\"PROCESSED\":1,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00243\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00243\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00283H\",\"TOTAL\":0,\"PROCESSED\":7,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00283H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":104,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00302\",\"TOTAL\":0,\"PROCESSED\":1395,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00302\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":5,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":0,\"PROCESSED\":299,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00304\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":16,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00310\",\"TOTAL\":0,\"PROCESSED\":2,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00365\",\"TOTAL\":0,\"PROCESSED\":588,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00365\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":619,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00479H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":4,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00479H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00607Bundle\",\"TOTAL\":0,\"PROCESSED\":1,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00646\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00646\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":2,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00681\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00721H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02071\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":2,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02229\",\"TOTAL\":0,\"PROCESSED\":1,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_02278\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_HOSPICE_CLM\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":1,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":15}]", "[{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00011H\",\"TOTAL\":0,\"PROCESSED\":1,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":16},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00011H\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":35,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":16},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_00061\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":1,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":16},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_HOSPICE\",\"TOTAL\":0,\"PROCESSED\":27,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":16},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_HOSPICE\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":60,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":16},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_HOSPICE_CLM\",\"TOTAL\":0,\"PROCESSED\":1240,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":0,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":16},{\"TARGETSYSTEM\":\"CPW\",\"ARUNAME\":\"CPW_HOSPICE_CLM\",\"TOTAL\":0,\"PROCESSED\":0,\"REMAINING\":0,\"ERROR\":0,\"FAILED\":0,\"SKIPPED\":14,\"PROCESSING\":0,\"DATE\":\"7/14/2024\",\"DAYHOUR\":16}]") | mvexpand data | rename data as _raw | spath ``` the above emulates index = ***** host=**** source=*** ```   The search used is the same as I posted previously (except substituting with your index search with emulation).   index = cba_hcck8s_UHGWM110-013948 host=prod_poc source=poc | fields - {}.* ``` optional ``` | spath path={} | mvexpand {} | fields - _* ``` optional ``` | spath input={} | eval totalCount = SKIPPED + PROCESSED | chart sum(SKIPPED) as SKIPPED,sum(PROCESSED) as Processed sum(totalCount) as TotalClaims by DAYHOUR DATE   And result is DAYHOUR Processed: 7/14/2024 SKIPPED: 7/14/2024 TotalClaims: 7/14/2024 15 5287 2930 8217 16 1268 110 1378 ... View more

Should be "%FT%H:%M:%S.%3Q%Z".  You can always test your time format with an emulation, like | makeresults format=csv data="eqtext:EventTime 2024-07-13T16:21:31.287Z" | eval _time = strptime('eqtext:EventTime', "%FT%H:%M:%S.%3Q%Z")   ... View more

In addition to what @ITWhisperer says, what is the physical significance of _time currently in your data?  Is there any reason why your ingestion should NOT use reported_date instead of whatever is used in current data?  That will make your requirement so much simpler to fulfill. (If this is a viable alternative, there could be other benefit, too.) This said, Splunk can always search records where reported_date falls within the last 15 months.  Here, I will illustrate with the following caveat: reported_date is always earlier than or equal to _time.  There can be other strategies to search if this condition is not true but unless that is a problem in your case, the following method is simpler. <your search criteria> earliest=-15mon | where relative_time(now(), "-15mon") < strptime(reported_date, "%F") ``` "%F" -> "%Y-%m-%d" ```   ... View more

First, thank you for using text to illustrate data, and clearly present desired result.  But next time make sure you preserve valid JSON syntax.  Your illustrated text is missing quotation marks required by JSON.  Correcting for syntax, I assume that the original data would look like   { "location": "US", "all_results": { "serial_a": { "result": "PASS", "version": "123", "data":[ "data1", "data2", "data3" ] }, "serial_b": { "result": "PASS", "version": "456", "data":[ "data4", "data5" ] }, "serial_c": { "result": "FAIL", "version": "789", "data":[ "data6", "data7" ] } } }   This same ask has come several times recently, and there are several ways to do this.  This time, I'll try something new, and less roundabout in logic.   | fields location | spath path=all_results | fields - _* | eval serial_number = json_array_to_mv(json_keys(all_results)) | mvexpand serial_number | eval all_results = json_extract(all_results, serial_number) | spath input=all_results | fields - all_results | rename data{} as data | eval data = mvjoin(data, ",")   You data gives location data result serial_number version US data1,data2,data3 PASS serial_a 123 US data4,data5 PASS serial_b 456 US data6,data7 FAIL serial_c 789 This is an emulation for you to play around and compare with real data   | makeresults | eval _raw = "{ \"location\": \"US\", \"all_results\": { \"serial_a\": { \"result\": \"PASS\", \"version\": \"123\", \"data\":[ \"data1\", \"data2\", \"data3\" ] }, \"serial_b\": { \"result\": \"PASS\", \"version\": \"456\", \"data\":[ \"data4\", \"data5\" ] }, \"serial_c\": { \"result\": \"FAIL\", \"version\": \"789\", \"data\":[ \"data6\", \"data7\" ] } } }" | spath ``` data emulation above ```     ... View more

Mathematically your question has no solution.  You can use round function to convert a number to 2 decimals.  But how do you "convert" a number into percentage?  Unless values of drive.current.max represents a ratio, this makes no sense.  Percentage compared with what? ... View more

that solution will work when we have a common field in both, but that's the case here What do you mean?  You don't need "common" field, if by that you mean identical entries.  Consider these two: IP_add.csv ip 10.110.1.152 10.16.8.11 10.16.8.240 cidr.csv cidr 10.16.8.0/24 If cidr.csv is set up with MATCH_TYPE(cidr), the above search will give you cidr ip match   10.110.1.152 "No Match" 10.16.8.0/24 10.16.8.11 10.16.8.0/24 10.16.8.0/24 10.16.8.240 10.16.8.0/24 Have you tried? ... View more

As @JohnEGones suggested, cidrmatch is not the answer.  Set MATCH_TYPE(cidr) in cidr.csv following that document, then use lookup command. | inputlookup IP_add.csv | rename "IP Address" as ip | lookup cidr.csv cidr as ip output cidr | eval match=if(isnull(cidr), "No Match", cidr)   ... View more

To make this question answerable, you need to also illustrate the content of your lookup.  Perhaps your lookup doesn't contain year? (Sometimes it makes more sense to not have year than having year.)  Also, if you only want to show events on nonHoliday, why the complicated post calculations? Assuming your lookup is like holidayDate holiday 1/1 New Year's Day 7/10 Don't Step on a Bee Day all you need is index=my_index | eval eventDate=strftime(_time, "%m/%d") | lookup holidayLookup.csv holidayDate as eventDate OUTPUT holidayDate | where isnull(holidayDate)   ... View more