Hi @bowesmana  Thanks a lot!!  You rock!!   I did make attempt on using evenstats, but then It didn't work because of  if condition didn't work.  It turns out I had to use a match command.    I appreciate your help. ... View more

Hi @isoutamo  So if I am using lookup editor, I don't need an intervention from the admin, including restarting or refreshing URL, correct? Thanks ... View more

Whenever I update/create collections.conf or transforms.conf file manually , should Splunk need to be restarted (by admin)? Same question if I use Lookup Editor app - should Splunk need to be restarted (by admin) after updating/creating collections.conf or transforms.conf? https://splunkbase.splunk.com/app/1724   I think once we have these answered, you have solved this post.   Thank you so much ... View more

Hi, Thanks for answering my questions. Since I can update transform.conf myself, I only need to an admin to create collections.conf, correct? Thanks again ... View more

Hello, Sorry I wasn't clear. I modified my questions a bit below I was referring Splunk UI as in the menu: Lookups >> Lookup definitions >> Add new My previous two questions specifically asked about a relationship between Splunk UI and transform.conf (not collection.conf) 1) Can I create KVStore lookup definition in Splunk UI without creating transform.conf file directly via command line? [Yes/No] 2) Will creating KVStore lookup definition in Splunk UI automatically update transform.conf file? [Yes/No] The reason I asked because I only have the ability to create lookup definition through Splunk UI Lookup menu (not lookup editor) and I was wondering if that would create transform.conf I appreciate your suggestion, here's my response to yours suggestion (although didn't answer my two questions) 1) maybe - but I don't have a way to test   2) PC is restrictive  3) not possible Thank you ... View more

Thanks for your suggestion. I read your the link you provided. So, I can't outputlookup data to KVStore without building KVcollection first, correct? Should I create transform.conf and collection.conf? I don't have admin right.   search data | outputlookup kv_store_lookup   https://docs.splunk.com/Documentation/Splunk/9.2.1/Knowledge/ConfigureKVstorelookups https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Outputlookup ... View more

Hi, Thank you for your suggestion. When I use a scheduled report, and see the recent search, Splunk appends "| summaryindex" at the end of the search, not "collect" command.   So, I thought "collect" always refers to "manual" push versus "summary index" in a scheduled report.  My understanding you have 2 scheduled reports. Is the following accurate? 1)  roll forward existing data (from and to the same summary index - say index A)  2) push new data (from a different index to summary index - say from index X to index A) In my case, the data from DBXquery is always get re-write, so I only need the latest data, but I may use your method in the future. Thanks for this. Based on the link that you sent and the following post, it looks like I still need the CSV file. (See below it does inputlookup to CSV first, then outputlookup to KV) Is this correct?    My goal is to avoid having CSV file since there's a limit in size   https://community.splunk.com/t5/Getting-Data-In/How-to-transfer-existing-CSV-data-to-kvstore/m-p/144641 | inputlookup filename.csv | outputlookup lookup_name Thank you again. ... View more

Hi So far, I didn't see any missing data, so it's not causing a problem, except for the error message. I am not sure why Splunk has to throw the error message.  Thank you for your help. ... View more

Hi, I am not sure the purpose of roll forward existing index. How do I use "collect" to write data in a scheduled report?  My understanding collect is a manual push. I am looking for automatic update daily. Where does KV store lookup save the data?  How do I move the DBXquery to KV store?  Does it require "admin"? What do you think about the "append command" in the previous post? Thank you so much for your help. ... View more

Hi, What I meant by splitting the data is to split the number of rows. So, if my query has 200k rows, splitting into 2, it becomes 100k rows. Or @marnall suggested split into a smaller queries..  not sure if it's possible since I have a large query involving multiple DBs I don't know how to do this in a scheduled report and write it into the same summary index with the same _time setting.  Please suggest. Thanks ... View more

Hi, Thanks for your help. No I do not care the order. I am afraid if I split the data and re-combine them it will return duplicate/missing data as it doesn't have a unique identifier. Also I don't know how to split the data and keeping the same _time.  Please help answer this. Thanks How do I split my query from DBXquery (eg. 200k rows)and push it into a Summary Index at the same time? ... View more

Hello, Thank you again for your help. Just to clarify,  I cannot set _time to the exact time every time I query the data, , correct? So, I need to filter the data last update, if I want to get the most recent copy. I currently are using CSV as a lookup, but the limitation is the size like you mentioned. I am trying to replace CSV lookup by doing the following:   Please let me know what you think. https://community.splunk.com/t5/Splunk-Search/How-to-perform-lookup-from-index-search-with-dbxquery/m-p/650654 | index=vulnerability_index | table ip_address, vulnerability, score | append [| dbxquery query="select * from tableCompany"] | stats values(*) as * by ip_address ... View more

How do I split my query from DBXquery (eg. 200k rows)and push it into a Summary Index at the same time? | dbxquery query=" SELECT * from Table_Test" the scheduled report for summary index will add something like this: summaryindex  spool=t  uselb=t  addtime=t  index="summary" file="test_file" name="test" marker="hostname=\"https://testcom/\",report=\"test\"" Technically, I don't really need the _time because it is a static data, but it needs to get updated every day. Thanks ... View more

Hello @gcusello  Sorry.. I tried again your last suggestion, but num and num2 still have type as "Number" I expect num2 has "String" type after using   num2= tostring(num,"commas")   Please suggest   Thanks again..   ... View more

@gcusello  Yes but why the first one is also string? The first one is number. Should I remove " " from typeof?        Thanks | makeresults | eval num = 1 | eval var_type = typeof(num) | eval num2 = tostring("num") | eval var_type2 = typeof(num2)   Thanks ... View more

They both became String.     Num should be number.  Thanks   ... View more

Hello @gcusello , I tried and the same result..  see below..  thank you   ... View more

Hello, Here's the image. I want to have the time range change based on the selected Grade. For example: If I select Kindergarten, the time will change to "last 24 hours" Thank you ... View more

Thanks for your suggestion I tried to simplify, but this is what I am trying to solve: https://community.splunk.com/t5/Splunk-Search/How-to-search-based-on-drop-down-condition/m-p/681366#M232829 ... View more