Hi, I didn't find anything about this while searching so here's my question. I'm working on the proving a negative problem, adding appendpipe after a stats in order to display a result of 0 for each day for the period of time I need. I usually do this for a single row, however I need to have multiple rows for multiple days as output for stats or more importantly timechart. I ran into a scenario I cannot explain and wanted to understand further. While testing I created this search:       | makeresults | eval value=0, category="test", _time=strftime(now(), "%H") | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-1d@d") ] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-2d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-3d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-4d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-5d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-6d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-7d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-8d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-9d@d")] | stats count by _time       The results of this output 256 results for a single date/time, and others follow with smaller amounts but not counts of 1. If I change it to this:       | makeresults | eval value=0, category="test", _time=relative_time(now(), "-2d@d") | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-1d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-2d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-3d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-4d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-5d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-6d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-7d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-8d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-9d@d") | dedup value category _time] | stats count by _time       Every row has a single count except for one, which makes sense given how this is written. I can move forward with this, but now I would like to know why this happens.      ... View more

I hope I explain this well. I have the following tstats search: | tstats max(_time) AS _time WHERE index=_internal sourcetype=splunkd source=*metrics.log by host I also have a lookup table with hostnames in in a field called host set with a lookup definition under match type of WILDCARD(host). In the data returned by tstats some of the hostnames have an fqdn and some do not. The problem becomes the order of operations. Say I do this: | tstats max(_time) AS _time WHERE index=_internal sourcetype=splunkd source=*metrics.log by host | lookup serverswithsplunkufjan2020 host OUTPUT host as match | eval "Sending Data?" = if(isnotnull(match), "Yes", "No") Then it gives me more hosts than I'm looking for. It'll indeed show where there is a match. When I search in this manner: | inputlookup serverswithsplunkufjan2020.csv | join type=left host [| tstats max(_time) AS _time WHERE index=_internal sourcetype=splunkd source=*metrics.log by host | eval seen=1] | eval "Sending Data?" = case(seen=1, "Yes", isnull(true), "No") | fields - seen It's using a join and who wants that? I can't seem to use lookup which I need for wildcards. I can use | inputlookup fine but I can't seem to make wildcard matching work there. I could do something like host IN ("foohost1*", "foohost2*") to search for what I need to gather, but I'd like to build something dynamic. ... View more

I've seen a lot about not using join subsearches, how it's slow, etc etc. Which proves to be true in practice. What I would like to find out is why it is slow. Any insight here would be helpful. ... View more

Hi, First time asking. I did a search, but maybe I used the wrong keywords. Apologies if this is a duplicate. I have two indexes that I want to compare two disparately named fields in. The data is IP addresses, so the string should be the same format across both. In SQL, I would do something like "where not in foo" or whatever. But, I have yet to figure out how to do a compare and then look for anything only in one index or only in the other index. Any tips would be appreciated. Thanks ... View more