I have a request from a user who wants to get some stats from the Exchange App around specific users. Namely they're looking for a count of incoming and outgoing messages.
There's a macro in the Exchange Application that would do what I need. Unfortunately, I would have to run it each time for each user they want to report on.
I was attempting to do something almost like a loop, passing the value from the csv lookup as an argument to the macro.
Is this possible?
map (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Map) seems like it should be close to what you want, but I've always had the devil of a time getting it to do anything the way I would expect.
Fields from external source 3 Answers