Thank you very much ... View more

@gcusello Thank you very much, this is a good solution. Very helpful as a beginner ... View more

Hi @gcusello  After I have executed the script, I don't see MissingFile.scv index=my_index source=FileA.csv OR source=FileB.csv OR source=FileC.csv OR source=MissingFile.csv | rex field=source "(?<Filename>\w+\.csv)$" | stats count BY Filename | append [ | makeresults | eval Filename=FileA.csv, count=0 | fields Filename count ] | append [ | makeresults | eval Filename=FileB.csv, count=0 | fields Filename count ] | append [ | makeresults | eval Filename=FileC.csv, count=0 | fields Filename count ] | append [ | makeresults | eval Filename=MissingFile.csv, count=0 | fields Filename count ] ``` | stats sum(count) AS Total BY Filename```   Something is missing here ... View more

@gcusello  rex field=source "(?<Filename>\w+\.csv)$" ? -> Zero or None <Filename> -> Could you please explain what exactly <Filename> is causing here w+ -> One or more letter, number, or _... .csv)$ Name of file must end with .csv ... View more

  Hi @gcusello after run index=my_index sourcetype="csv" source=FileA.csv OR source=FileB.csv OR source=FileC.csv OR source=FileD.csv | rex field=source "(?<Filename>\w+\.csv)$" | stats count BY Filename | append [ | makeresults | eval Filename=FileA.csv, count=0 | fields Filename count ] | append [ | makeresults | eval Filename=FileB.csv, count=0 | fields Filename count ] | append [ | makeresults | eval Filename=fileC.csv, count=0 | fields Filename count ] | append [ | makeresults | eval Filename=fileD.csv, count=0 | fields Filename count ] | stats sum(count) AS Total BY Filename   I still see only A,B,C ... View more

@gcusello  if I run: index=my_index sourcetype="csv" source=FileA.csv OR source=FileB.csv OR source=FileC.csv OR source=FileD.csv | rex field=source "(?<Filename>\w+\.csv)$" | stats count BY Filename | append [ | makeresults | eval filename=FileA.csv, count=0 | fields Filename count ] | append [ | makeresults | eval filename=FileB.csv, count=0 | fields Filename count ] | append [ | makeresults | eval filename=fileC.csv, count=0 | fields Filename count ] | append [ | makeresults | eval filename=fileD.csv, count=0 | fields Filename count ] | stats sum(count) AS Total BY Filename I see only A,B and C D is not available and must be displayed with 0 ... View more

Hi @gcusello  >(| where total=0) yes, that makes sense >Results>0 yes, that makes sense too please stay available, now i try without lookup table. Thank you very much for the support ... View more

@gcusello ok, I'll try to understand it later. Now I have to do my task. When I have this output: Can I create an alert like this: Trigger condition: search Total != 1 Is there a more elegant solution? ... View more

@gcusello  I have the problem not with RegEx, but with the variable: Filename. Where is this variable initialized ... View more

@gcusello  >this means that you have three events but yu haven't the field Filename. >If you run only the main search (first row) in Verbose Mode, have you this field in Interesting fields? >probably not Thank you, I understood that   Now please return to my task if I run: index=my_index | rex field=source "(?<Filename>\w+\.csv)$" | stats count BY Filename | append [ | inputlookup Lookup_table_with_filename1.csv | eval count=0 | fields Filename count ] | stats sum(count) AS Total BY Filename I see: I don't understand what this (second line) line is for. | rex field=source "(?<Filename>\w+\.csv)$" Is it possible without RegEx? ... View more

@gcusello  I see: 3 events but no results Thank you for your time! ... View more

@gcusello  After run this: index=my_index | stats count BY Filename | append [ | inputlookup Lookup_table_with_filename1.csv | eval count=0 | fields Filename count ] | stats sum(count) AS Total BY Filename I see: ... View more

@gcusello unfortunately I do not see any differences index=my_index | stats count BY Filename | append [ | inputlookup Lookup_table_with_filename1.csv | eval count=0 | fields Filename count ] | stats sum(count) AS Total BY Filename   ... View more

Hi @gcusello  Many thanks for your help! Method with lookup table: I have created and uploaded a table: I have assigned FileA.csv, FileB.csv, FileC.csv to my_index "FileD.csv" is missing in my_index and should be send by email. What am I doing wrong? ... View more

@PickleRick Thank you, now I understand how the assignment works We have a folder in production where it automatically looks, so I thought Splunk automatically looked in the home folder. That was a misunderstanding. ... View more

Hallo @PickleRick  I have already uploaded my files: file1.csv, file2.csv, file3.csv as described here: https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-CSV-file-from-a-local-machine/m-p/232138 ... View more

@gcusello  I would like to better understand the background processes and have installed Splunk on my Windows machine. I am now wondering how to get from my home: C:\Program Files\Splunk Access any file via search console: I created index: I created the following files: C:\Program Files\Splunk\worldcities.csv C:\Program Files\Splunk\worldcities1.csv C:\Program Files\Splunk\worldcities2.csv In the search console   index=my_index sourcetype="csv" source="worldcities.csv" | stats dc(source) as fileCount   And I have fileCount: 0, so the file does not exist ... View more

Hi @gcusello  Thanks for the quick reply! I am not allowed to create a new file. It is only 2-3 files. Later I can catch it with regex What I think:   index=o sourcetyp=txt source="*\file1.txt" OR "*\file2.txt" OR "*\file3.txt" // if possible | stats sum(source) AS total BY fileName - stats dc(source) as fileCount // if file2.txt is missing | where total != 0   -> alert trigger, I need name of "file2.txt" to send by email Sorry, I am absolute beginner here ... View more