Worked fine, thanks ... View more

index="proxy_logs" OR index="websitelist" category="none" cs_Referer!="-" | stats values(cs_Referer) AS cs_Referer values(url) as url by requestID | eval results = if(match(upper(cs_Referer),upper(url)), "hit", "miss") | where results="miss" produces no results index="proxy_logs" OR index="websitelist" category="none" cs_Referer!="-" | stats values(index) as indexes by url | where mvcount(indexes)=1 AND indexes="bcoat_logs" Produces results, but I need to confirm the output data. What I am trying to do is look up all the urls in the proxy_logs where the url with an unknown category that does not match the cs_Referer then mark it as a "miss". Then check the "miss" results against the second index "websitelist" url Other issues is that the "proxy_logs" outputs url not just as a domain name... http:// , www. etc. The "websitelist" has just the domain. Thanks, ... View more

No results on this one . ... View more

I was hoping to include, as I want to check the output is a miss. | eval results = if(match(upper(cs_Referer),upper(url)), "hit", "miss") | where results="miss" Thanks, ... View more

index="proxy_logs" filter_results=OBSERVED | eval MB=upload/(1024*1024) | stats sum(upload) as total by date,userID,url,MB upload | where total > 10000000 does the conversion to MB - still need to aggregate the user upload ... View more

I also need to figure out how to aggregate the data or just show the highest upload by the user ... View more

index="proxy_logs" filter_results=OBSERVED | stats sum(upload) as total by date,time,userID,url | where total > 10000000 Thanks again for your help. ... View more

| stats sum(upload) as total by user | where total > 10000000 Works great. So if I wanted to add this output to a table, with other information such as date, time, user, url, upload? ... View more

| stats sum(upload) as total by userID | where total > 10000000 Works great. So if I wanted to add this output to a table, with other information such as date, time, user, url, upload? ... View more

Ok I finally got it working and have a better understanding, thanks to everyone for your support. | ldapsearch domain="default" search="(&(samAccountType=805306368))" | lookup user_lookupnew.csv member AS displayName OUTPUT member AS name | where isnotnull(name) ldapsearch | ldapsearch domain="default" search="(&(samAccountType=805306368))" Lookup CSV | lookup user_lookupnew.csv member column A1 header member AS ldapsearch display name displayName ... View more

I only know the userID , so in the csv - column A, row 1 I have the word "member" as the header and the after that in column A, row 2 the userID that I want to lookup. Does there need to be a second column B called "name" that will get populated? ... View more

CSV file looks like this A B 1 member 2 userID 3 userID 3 userID Do I need to change the format? ... View more

yes A1 is the header A2 and so on is the userID that I need to lookup. ... View more

Do I need to tell the lookup where to look for the userID in the "sAMAccountName"? ... View more

A1 member A2 userID A3 userID A4 userID and so on. ... View more

| ldapsearch domain="default" search="(&(samAccountType=805306368))" attrs="sAMAccountName" ... View more

ok I have tried | ldapsearch domain="default" search="(&(samAccountType=805306368))" | lookup user_lookupnew.csv member as member OUTPUT member AS found_member | where isnotnull(found_member) but no data I need to search data under sAMAccountName ... View more

| ldapsearch domain="default" search="(&(samAccountType=805306368))" | lookup user_lookupnew.csv member as member OUTPUT member AS found_member This part works fine. The last part creates an error | where insnotnull(found_member) Error in 'where' command: The 'insnotnull' function is unsupported or undefined. ... View more

| ldapsearch domain="default" search="(&(samAccountType=805306368))" | lookup user_lookupnew.csv member as member OUTPUT member This search shows all user rather than just the ones in the CSV ... View more

yep only one ... View more

A1 = member A2 = user ID A3 = user ID and so on, looking to search all the users in the list. | ldapsearch domain="default" search="(&(samAccountType=805306368))" | lookup user_lookupnew.csv member as member OUPUT = a field in the csv or the a field for the ldapsearch? ... View more

Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table ... View more