I am trying to get the data into a chart from an index were a user may answer a question daily.  This is what I need to produce: email sun mon tue wed thu fri sat bob@email.com - NO NO NO Yes - - aaron@email.com Yes - - NO - - - chuck@email.com NO NO NO Yes NO - Yes This i s what I am currently getting: email sun mon tue wed thu fri sat bob@email.com - - - - Yes - - bob@email.com - - - NO - - - bob@email.com - - NO - - - - bob@email.com - NO - - - - - aaron@email.com - - - NO - - - aaron@email.com - - - NO - - - aaron@email.com Yes - - - - - - chuck@email.com - - NO - - - - chuck@email.com - - - - NO - - chuck@email.com - - - Yes - - - chuck@email.com NO - - - - - - chuck@email.com - NO - - - - - chuck@email.com - - - - - - Yes Here is what I have so far, but I am stuck and not to sure what process I should use: index=someindex  | eval qualdayOfWeek=strftime(_time, "%a") | rex field=_raw "is\s(?<status>(NO|YES))\sto" | eval sun=if(qualdayOfWeek="Sun", $status$, "-") | eval mon=if(qualdayOfWeek="Mon", $status$, "-") | eval tue=if(qualdayOfWeek="Tue", $status$, "-") | eval wed=if(qualdayOfWeek="Wed", $status$, "-") | eval thu=if(qualdayOfWeek="Thu", $status$, "-") | eval fri=if(qualdayOfWeek="Fri", $status$, "-") | eval sat=if(qualdayOfWeek="Sat", $status$, "-") | table email, sun, mon, tue, wed, thu, fri, sat ... View more

In my lookup table, I have the days of the week as columns with "Y" or "N" in the field (not able to change this as this is how the data is provided). I would like to return only the results from the lookup table that matches the day of the week and the day of the week columns with "Y".  I have been looking at using IF statements and Where clauses, but not really getting it. The data columns look like this: Mon Tue Wed Thu Fri Sat Sun Y N Y N N N N N Y N Y N Y N   I have been extracting the day by using dayOfWeek=strftime(_time, "%a") from the imbeded search query: | inputlookup somecsv.csv | join email [search index=someindex | eval dayOfWeek=strftime(_time, "%a")] | table or stats (data from inputlookup that matches the days of the week from the search) This is where I get stuck. Any help will be greatly appreciated.  ... View more

I am trying to get the following results for date, email and answer with the other data into separate rows: Results I am getting: Results I need to see: Search Query: index=someindex  | eval status=case(like(_raw, "%NO%"), "NO", like(_raw, "%YES%"), "YES") | lookup fall2020OnCampusStudents email OUTPUT class, name, ID, className, classNumber, college | search class!="" | table Date, name, email, ID, status, class, className, classNumber, college | sort college, email, class | rename email AS "Email", status AS "Answer", class AS "Classes", className as "Class Name", classNumber as "Class Number", college as "College" I have tried using mvexpand, but it will only take the first line of each field. I am still trying to understand other techniques, but still learning.      ... View more

I am searching for a user list that I have in a inputlookup/lookup CSV. I need to compare results from a search to the inputlookup/lookup list which is over 80k users and return only the new results that are not in the CSV. This is my search: index=blahblah event_type=login | convert timeformat="%m/%d/%Y" ctime(_time) AS date | stats earliest(date) AS date by unique_id | lookup userlist unique_id AS unique_id OUTPUTNEW unique_id AS match | where isnull(match) This does kind of work, but I believe I am hitting the max_output_limits for a subsearch. Any help would be greatly appreciated. ... View more

When I go to setup G Suite Create New Google Apps Input for the Activity - Admin I get an a flag saying that I need to configure the Extra Config must be valid for JSON. Which in the instructions is says "These inputs generally do not require Extra Configuration options in the Modular Input." for the report of admin. Need help fixing this issue. ... View more