You can add a prefix and suffix to the token and use a change handler on your input to reset the token to be empty if the user has not put anything in the text field. <input type="text" token="attachment"> <label>Attachment search $attachment$</label> <default></default> <change> <eval token="attachment">if($form.attachment$ == "","",$attachment$)</eval> </change> <prefix>attachments="</prefix> <suffix>"</suffix> </input> You then use the token in your search index=email source=/var/email_0.log $attachment$ sha256=$hash$ ... View more

| appendpipe [| stats count | where count==0] ... View more

| makeresults format=csv data="raw CSR-345sc453-a2da-4850-aacb-7f35d5127b21 - Sending error response back in 2136 msecs. 00012243asdsfgh - No recommendations from System A. Message - ERROR: System A | No Matching Recommendations 001b135c-5348-4arf-b3vbv344v - Validation Exception reason - Empty/Invalid Page_Placement Value ::: Input received - Channel1; ::: Other details - 001sss-445-4f45-b3ad-gsdfg34 - Incorrect page and placement found: Channel1; 00assew-34df-34de-d34k-sf34546d :: Invalid requestTimestamp : 2025-01-21T21:36:21.224Z 01hg34hgh44hghg4 - Exception while calling System A - null Exception message - CSR-a4cd725c-3d73-426c-b254-5e4f4adc4b26 - Generating exception because of multiple stage failure - abc_ELIGIBILITY 0013c5fb1737577541466 - Exception message - 0013c5fb1737577541466 - Generating exception because of multiple stage failure - abc_ELIGIBILITY b187c4411737535464656 - Exception message - b187c4411737535464656 - Exception in abc module. Creating error response - b187c4411737535464656 - Response creation couldn't happen for all the placements. Creating error response." | rex field=raw max_match=0 "(\b)(?<words>[A-Za-z'_]+)(\b|$)(?!\-)" | eval words = mvjoin(words, " ") ... View more

We can't see what might be wrong with your search if we can't see the actual events the search is running against. Please share some anonymised events which demonstrate the issue you are facing. ... View more

Please provide some sample events which demonstrate the issue you have with your search ... View more

Please provide some sample events which demonstrate the issue you have with your search ... View more

Your stated requirement does not match completely with your examples. For example, some expected outputs have fewer "words" than are available in the "field". Also, is there an unwritten requirement that your "words" begin with a letter but could contain numbers? Making some assumptions derived from your written requirement and expected outputs, you could try something like this | makeresults format=csv data="raw 00012243asdsfgh - No recommendations from System A. Message - ERROR: System A | No Matching Recommendations 001b135c-5348-4arf-b3vbv344v - Validation Exception reason - Empty/Invalid Page_Placement Value ::: Input received - Channel1; ::: Other details - 001sss-445-4f45-b3ad-gsdfg34 - Incorrect page and placement found: Channel1; 00assew-34df-34de-d34k-sf34546d :: Invalid requestTimestamp : 2025-01-21T21:36:21.224Z 01hg34hgh44hghg4 - Exception while calling System A - null" | rex field=raw " (?<dozenwords>([A-Za-z][A-Za-z0-9]*[^A-Za-z0-9]+){0,11}[A-Za-z][A-Za-z0-9]*)" ... View more

That sounds right 😀 ... View more

What is you current query? ... View more

This is too vague - please explain what you are trying to achieve, what you have tried and what results you have so far ... View more

| makeresults | eval start_date = "2024-01-01", end_date = "2024-01-07" | eval start_timestamp = strptime(start_date, "%Y-%m-%d") | eval end_timestamp = strptime(end_date, "%Y-%m-%d") | eval num_days = round((end_timestamp - start_timestamp) / 86400) | eval all_dates = start_date | eval range = mvrange(1, num_days + 1) | foreach mode=multivalue range [| eval all_dates=mvappend(all_dates,strftime(relative_time(start_timestamp,"+".<<ITEM>>."d"),"%Y-%m-%d"))] | fields all_dates ... View more

Please share some actual (anonymised) events so we can see what you are actually dealing with. Also, provide an example of the type of output you are looking for. ... View more

Since you are generating these events with a script, modify the script to include a real timestamp at the beginning of the event (and if necessary configure the sourcetype to extract it) ... View more

Splunk is trying find a timestamp in your events - unfortunately your account id look like the internal representation of a date time i.e. number of seconds since 1st Jan 1970, so Splunk assigns the timestamp accordingly   ... View more

Try setting your alert to look back at least 15 minutes and use a search like this | eval starttime=if(event="Starting",_time,null()) | eval stoptime=if(event="Stopping",_time,null()) | sort 0 _time desc | streamstats time_window=15m latest(stoptime) as nextStop | eval alert=if(isnull(nextStop) and time() - starttime > 15*60, "missing", null()) ... View more

How are the two events linked? Can there be more that one "start" before any "stops"? Can "start/Stop" pair be intertwined? How frequently do you want to check? ... View more

Splunk's version of arrays is multivalue field, so if you change you input to a multivalue field, you could do something like this | eval Tag = split(lower("Tag3,Tag4"),",") | spath | foreach *Tags{} [| eval field="<<FIELD>>" | foreach <<FIELD>> mode=multivalue [| eval tags=if(isnull(tags),if(mvfind(Tag,lower('<<ITEM>>')) >= 0, field, null()),mvappend(tags, if(mvfind(Tag,lower('<<ITEM>>')) >= 0, field, null())))] ] | stats values(tags) ... View more

What does your expected output look like? ... View more

Please provide some anonymised sample events, a description in non-SPL terms of how the events are to be processed and how they relate to an expected output. ... View more

This is different from what you originally asked for. Worse than that, the expected output is subtly different to your input events. Please can you explain precisely how the input events are to be processed to give the expected output? ... View more

From what you have shared (which is all I can go on), are you saying that the events which have been marked as "SENDING" in the type are not actually "Sending" messages? If so, presumably they also don't have a type field? Please can you share accurate but anonymised examples of the all event types you are trying to process because doing it piecemeal is not very productive. ... View more

| stats values(type) as types values(_time) as times by displayId Note that this will give you the times in internal format (number of seconds since the beginning of 1970) If you want the times formatted, you should create a field with the formatted version and collect those values. ... View more