Report NOT running 1 week

[dm2]

I have this query in my report scuedhled to run every week, but results are for all time, how can i fix ?

index=dlp user!=N/A threat_type=OUTGOING_EMAIL signature="EP*block" earliest=-1w@w latest=now
| stats count by user _time
| lookup AD_enrich.csv user OUTPUTNEW userPrincipalName AS Mail, displayName AS FullName, wwwHomePage AS ComputerName, mobile AS Mobile, description AS Department, ManagerName, ManagerLastName
| table _time, Users, FullName, Mail, Mobile, ComputerName, Department, ManagerName, ManagerLastName, count

[isoutamo]

Hi

that "earliest=-1w@w" is correctly to get all events from 1 week backwards and starting from first day of that week. Based on that you should get those events what you want.

Have you look from _internal that this report hasn't run or is it just your email systems which cannot manage it due for amount of events or something else?

BUT you have this "stats count by user _time" which calculates how many times user existed in particular time which can be e.g. millisecond. That could leads you to calculate every event separately, which probably is not what you are looking for? Maybe you want to those events e.g. daily base (add "|bin span=1d _time" before stats)?

r. Ismo