Hi, You provide too little information for me to be sure to create a working solution for you, but I can give som feedback based on how I interpret the information supplied in the question. If you want to filter out events that does not include the usernames you could use a query like this: index=windows EventID=4624 OR EventID=540 OR EventID=528 NOT [|inputlookup trusted_users.csv| fields + names] The above inputlookup returns a list of the content of names-field, while the NOT notation would exclude all events containing one or more of the values in the names-field. The search assumes that the trusted users in the CSV-file are in the field names . A possible implementation in your query would be something like this: index=windows EventID=4624 OR EventID=540 OR EventID=528 NOT [|inputlookup trusted_users.csv | fields + names] |eval c_time=strftime(_time,"%m/%d/%y %H:%M:%S") |stats values(user) by host The search assumes that the trusted users in the CSV-file are in the field names . Hope this helps! Cheers, ... View more

Splunk is able to import any text-based formats, but Excel files with extensions like .xls og .xlsx are not text-based. This means that you cant read the Excel files directly in Splunk, but you have to convert it to CSV. (I might be incorrect here, but I cant find any information about Splunk starting to support Excel files.) In addition you would have to extend your search string to include som kind of lookup -query. There was a "guide" for something similar in the Splunk blog a few years back. It might help you out. http://blogs.splunk.com/2015/01/30/working-with-spreadsheets-in-splunk-excel-csv-files/ Cheers, ... View more

I believe that what you are looking for is savedsearch, which you kind of touch with your third example. Saved searches can be created two ways, either through the interface(Settings -> Searches, reports, and alerts -> New) or by editing(or creating) a savedsearch.conf in the apps directory( ..\etc\<app>\local\savedsearch.conf ). To include the variable names in the saved search you have to specify a placeholder variable: index=test sourcetype=<my-sourcetype> host=$my-variable$ ..... When wanting to use the savedsearch in a panel, specify the search string for the panel like this: | savedsearch <my-saved-search> my-variable=<my-input-token> Now you should be able to use the same search string in all the dashboards and only have to edit the main search string one place. Here is an example of a minimal savedsearch.conf for the saved search test : [test] description = A minimal test example of savedsearch with variable search = index=* sourcetype=test | extract pairdelim="; " kvdelim=":" | search user=$my-variable$ Cheers, ... View more

Try specifying space-character as a pair delimiter as well. index=* sourcetype=orange | extract pairdelim="; " kvdelim=":" For me that gave the correct and expected result. user:hgfh std:6 status:success I suspect that since the kv extract is "mid-sentence" it tries to outrule anything that does not fit exactly with the specified pair delimiter. Thus resulting in the return of only two kv-pairs unless you specify space and semicolon as pair delimiters. Cheers, ... View more