I think I may not be explaining a key part of this well enough (or if I am misunderstanding your explanation, I'm sorry!). I need ALL ResourceIds from index=main. The only values I need to filter out are instance IDs (i.e. i-1234567abcdef) that are NOT found in index=other. So let's say index=main ResourceId=* returns: i-1234567abcdef i-abcdef1234567 sg-12345abcde etc. (any other value that is not an instance ID) and the index=other search returns InstanceId: i-abcdef1234567 I need the results to be (filtered out i-1234567abcdef because it was not returned by index=other): i-abcdef1234567 sg-12345abcde So I guess a way to think about this is that I am trying to remove any value from ResourceId that matches the string "i-*" IF it was NOT found in index=other, and THEN coalesce ResourceId and InstanceId into a single field.  ... View more

I really appreciate the suggestion. You do seem to get what I'm after, though the mvcount(indexes) returned no results. It seems so simple to me conceptually, but finding it very frustrating to try and wrap my head around "how splunk does it". I'm trying to include just the InstanceIds seen in both indexes while keeping the rest of the values from ResourceId in index=main. Index=main contains many different values in ResourceId (some of which are instance IDs). Index=other has a field called InstanceId.  This works, but I am not sure how to filter the MV index results (where mvcount(index)=2 did not work)     (index=main ResourceId=i-*) OR (index=other type=instance earliest=-2h) | eval InstanceId=coalesce(ResourceId, InstanceId) | stats values(index) as index by InstanceId       I've tried to use if/match, which sounds like it is exactly what I need, but it looks like you can't specify dynamic values for the match.      (index=main ResourceId=i-*) OR (index=other type=instance earliest=-2h) | eval InstanceId=if(match(ResourceId, InstanceId, ResourceId, "null")) | stats values(index) as index by InstanceId       ... View more

The first one did end up working for me. The second one for whatever reason was throwing Error in 'SearchParser': Mismatched ']'. Not a big deal for me since the first one works, but figured I'd mention it. | rex field=_raw "Key\": \"Owner\", \"ValueString\": \"(?<Owner>[^"])\"}," The second one is what I thought I was doing... capturing everything until it saw "},   🙂 Thank you for helping me with this! ... View more

Edit: I realized I may have given the wrong impression by posting my example JSON object. The intention was to extract a value from any of the 3 fields into the single column.  1. Yes, field3 is "Resource Name".  2. Yes 3. I used "Attribute Name" and "ID" as placeholder values for the real data (just sanitizing the values/fields). They were just meant to give an example. In hindsight I think I should have stuck with generic names "field1-3".   Output format: event.AccountId event.CloudPlatform event.CloudService Additional Details xxxxxxxxxx CloudProvider Service name-resource-121sg6fe ID-12132423fgrg other-named-attribute ... View more

Thank you @bowesmana and @yuanliu for helping with this!  This worked, but I just had to add a ) at the end to balance the parenthesis. The values when tabled out all include "event" in addition to the targeted values, which I'm guessing is somehow coming from the top element in the array. Not a huge problem for me, but figured I'd mention it. Results: event name-resource-121sg6fe event name-resource-387762fg   Sample JSON array: event: { AccountId: xxxxxxxxxx CloudPlatform: CloudProvider CloudService: Service ResourceAttributes: {"key1": "value1", "key2": "value2", "key3": value3, "key4": [{"key": "value", "key": "value"}], "Resource Name": "name-resource-121sg6fe", etc} }   ... View more

I get this error whether I use <<FIELD>> or <<ITEM>>.  Error in 'EvalCommand': The arguments to the 'mvappend' function are invalid. | eval type=mvappend(if(isnotnull('<<ITEM>>'), '<<ITEM>>', type)) ] ... View more

@bowesmana just wanted to tag you for awareness, not sure how this community notifies on comment replies. 🙂 ... View more

What is expected for <<FIELD>>? What value would I add here to get it to cycle through all 3 (or more) values extracted from the spath object? ... View more

This seems to technically work, however I am left with an unwanted "count" column at the end that I don't know how to remove. As an example of what I'm after, I've included the "Target Output" below.  Actual Output: Target Output:   ... View more

Hi Yuanliu, The query field is the domain visited (e.g. www.youtube.com) I am just renaming that field to "Domains". The Workstation is the hostname of the user's computer (e.g. ABC193423). I am ultimately looking to return unique values for the domains seen, but only the highest count (e.g. in the current results, if a user goes to www.youtube.com 3 times, it will show up 3 times in the search as 1 :, 2 :, 3 :, etc.). The intention here is to see how many times a domain was visited on a given Workstation, and include the User that accessed the domains. So the search can either return only the highest count seen for a domain, OR I can sort the counts descending to get the highest hits on top (this is meant to be a workaround to get the search working until I can figure out how to remove the "duplicated" lower counts). I thank you for your suggestion, but unfortunately it did not change how the data was populated. It was still ascending the counts.   ... View more