https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Proxy-Log-Query-Explanation-Needed-Regarding-xswhere/m-p/178304#M817 <P>Hi, that's coming from the Extreme Search module: <A href="http://docs.splunk.com/Documentation/ES/3.3.0/User/ExtremeSearch">http://docs.splunk.com/Documentation/ES/3.3.0/User/ExtremeSearch</A></P> Fri, 01 May 2015 17:20:31 GMT jcoates_splunk 2015-05-01T17:20:31Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Proxy-Log-Query-Explanation-Needed-Regarding-xswhere/m-p/178303#M816 <P>I can not find anything in the docs regarding "xswhere" and this "is above high"<BR /> Here is the query :<BR /> | tstats allow_old_summaries=true count as web_event_count from datamodel=Web by Web.src, Web.http_method | <CODE>drop_dm_object_name("Web")</CODE> | xswhere web_event_count FROM count_by_http_method_by_src_1d in web by http_method is above high</P> <P>Any help would be appreciated thanks.</P> Mon, 28 Sep 2020 19:48:20 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Proxy-Log-Query-Explanation-Needed-Regarding-xswhere/m-p/178303#M816 tegosa 2020-09-28T19:48:20Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Proxy-Log-Query-Explanation-Needed-Regarding-xswhere/m-p/178304#M817 <P>Hi, that's coming from the Extreme Search module: <A href="http://docs.splunk.com/Documentation/ES/3.3.0/User/ExtremeSearch">http://docs.splunk.com/Documentation/ES/3.3.0/User/ExtremeSearch</A></P> Fri, 01 May 2015 17:20:31 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Proxy-Log-Query-Explanation-Needed-Regarding-xswhere/m-p/178304#M817 jcoates_splunk 2015-05-01T17:20:31Z