Hi, Is there any way to specify a start point when using DELIMS for field extraction? An example, the log looks like this: Sep 13 Some Variable Format String: value1 value2 value3 value4 value5... I want to extract the "valueX" using a space delimiter. But the beginning of the log has a section with variable number of spaces, which would break the order of fields. Is there any way to specify where the DELIMS extraction should start from? Other than having to extract in a new field the list of values with regex (value1 value2 value3 value4 value5...), then use DELIMS on the new field, and at the end set the new field to null()? Thank you. ... View more

Is it possible to store a search string in a lookup column, retrieve the content and run it as a search? For example: index=some_index | lookup test.csv lookup_key_field as event_code OUTPUT spl_field as search_string | ... some command to actually run the search_string ... ... View more

Hello, In a timerange (lets say 4 hours) I am trying to find password resets and after that, for the same user, all the logins. Is it possible to this in a search? I was looking at append but I don't see how I can use the field user and _time from first search (finding the password resets) to filter the second search (finding the logins) Thank you. ... View more

Is there any way that a notable is linked to the events that generated it? ... View more