Thanks Shreya, it worked..  had one more doubt as well. please have look if you could help. job time file status one 10:50 abc waiting two 11:30 def waiting three 11:45 hij Waiting   now, if there is a job four is going to have file name as "def", i dont want it to be added to next line. instead i want is like table 2 below. if file name is same, want the status to be changed to collected and also other values added to table horizontally.    job time file status job2 time2 one 10:50 abc waiting     two 11:30 def collected four 12:00 three 11:45 hij waiting     ... View more

Thanks Giuseppe, sorry for inadequate information. Actually, my input must be given in as "text" and that value must be substituted to both source file and destination file. for eg: if the input am giving is "peacock" this value should be given to both source file and destination file, like: index=my_index (sourcefile="peacock" OR destinationfile="peacock") . hope this explains it clearly. ... View more

Thanks Giuseppe, it worked for me. but there is one other thing here, I need to populate the values as "NA" if the value is not present in my output column. ... View more

Hi, I have created a dashboard based on various search criteria. I would like to add a column to this, based on one of the output column i need to hard code a value. can anyone please suggest a way to do this. for ex: existing output: abc one def two Information need to be hardcoded: one--> red two-->black needed output: abc one red def two black ... View more

Please find the below snippet. I'm not able to see the permission options. My lookup table is Domain_Data and there is no permission option shown here. /usr/splunk0/splunk/etc/users/adcgrhh/bnym_fxr_srv/lookups/Domain_Data.csv adcgrhh bnym_fxr_srv Private Enabled Move | Delete /usr/splunk0/splunk/etc/apps/search/lookups/GlobalExclusionList.csv xbbl6f9 Global | Permissions Enabled ... View more