Hi All, I have a query to get the result of the list of filesystems and their respective disk usage details as below: File_System  Total in GB   Used in GB   Available in GB   Disk_Usage in % /var                   10                    9.2                   0.8                           92 /opt                   10                    8.1                   1.9                          81 /logs                 10                    8.7                   1.3                          87 /apps                10                    8.4                   1.6                          84 /pcvs                10                    9.4                    0.6                         94 I need to create a dropdown with the disk usage values to get the above table for a range of values. For e.g. If I select 80 in the dropdown it will show the table with values of disk usage in the range 80-84, then if I select 85 in the dropdown it will show the table with values of disk usage in the range 85-89 and so on. I created the dropdown with token as "DU" and created the search query for the table as: .... | search Disk_Usage=$DU$ | table File_System,Total,Used,Available,Disk_Usage | rename Total as "Total in GB" Used as "Used in GB" Available as "Available in GB" Disk_Usage as "Disk_Usage in %" But with this query I am able to get the table for a single disk usage value only. Please help me create a query so that upon selecting an option in the dropdown will give the table for a range of disk usage values.

Hello, I'm attempting to use the regex command to filter out any records on the "user" field that do not match the written expression below: index=myindex sourcetype=traceability_log4net earliest=-10d | regex _raw="user=[a-z]{3,6}[a-z1-9]{1,2}" | table user Per the expression, there should not be any "user" records that exceed 8 characters. However, the non-matching values are not being filtered out. "sstevenson6111", for example,  should theoretically be listed as "sstevens" per the expression.  I'm sure there's something blindingly obvious that I'm missing!   

Log4J Query:   index=* | regex _raw="(\$|%24)(\{|%7B)([^jJ]*[jJ])([^nN]*[nN])([^dD]*[dD])([^iI]*[iI])(:|%3A|\$|%24|}|%7D)" | eval action=coalesce(action_taken, elb_status_code, status) | where NOT (cidrmatch("192.168.0.0/16",src_ip) OR cidrmatch("10.0.0.0/8",src_ip) OR cidrmatch("172.16.0.0/12",src_ip)) OR Country="United States" | iplocation src_ip | eval notNULL="" | fillnull value="unknown" notNULL, src_ip, dest_ip, action, url, Country | stats count by src_ip, Country, dest_ip, url, action, sourcetype | sort - count​   This checks anywhere where there is a sign of the Log4J exploit being used.  I've done field extraction on any sourcetypes returned by my previous query:  index=* | regex _raw="(\$|%24)(\{|%7B)([^jJ]*[jJ])([^nN]*[nN])([^dD]*[dD])([^iI]*[iI])(:|%3A|\$|%24|}|%7D)" | stats count as "exploit attempts" by sourcetype | sort - "exploit attempts" I extracted fields so that I can get a table with src_ip, Country, dest_ip, url, action, sourcetype, and count. I want to then use this query in subsequent queries to get information on if the exploit was successful, and if there is any other communication that follows.   The query works and I get results like this (fake results): src_ip Country dest_ip url action sourcetype count 248.216.243.59 Unknown 192.168.1.148 192.168.1.148/ blocked firewall 3 207.191.80.208 US 192.168.1.216 192.168.1.216/ allowed firewall 2    Problem being... The query runs really slow after a few minutes of running. It starts out by doing millions of events every few seconds and slows down to doing thousands every few seconds.  Some info from logs: command.search, command.search.kv, and dispatch.stream.remote take up the most time of the run. I'm getting warnings in search.log like "Max bucket size is larger than the index size limit" , "Invalid field alias specification in stanza". However, these don't seem to be the reason for the error. Using high_perf and Fast Mode If there is any more information I can add, then feel free to ask and I will edit.  

Need help on enterprise security. Is there a way to create a standard TAXII Parser that can do correlation searches of logs coming from Maritime Transportation System ISAC & logs coming from Stash. New to ES and have no idea what's all about. See the issue below, If it'll help. Please advise and help, on what's needed to be done. I am very new to ES. Thanks   "A shipping company that gets Intelligence feeds/reports from MTS-ISAC (Maritime Transportation System ISAC) The MTS-ISAC provides proactive cyber threat intelligence, alerts, warnings, and vulnerability information cultivated from maritime stakeholders and public and private sector shares, open-source intelligence, and cybersecurity news So it's just a matter of parsing that information so Matson can do correlation searches (correlate it with logs) that are currently coming from Stash"  

Hi, I have 3 panels which are displaying SIngle value, with a condition if result count is zero, that panel should not display on dashboard. However, it is not working properly. Stll the panels are hidden even though result count is > 0 for all. How can this be fixed? <dashboard> <init> <set token="eduration">-24h@m</set> <set token="lduration">now</set> </init> <row> <panel depends="$show$"> <single> <title>Panel</title> <search> <query>sarch_queryt</query> <earliest>$eduration$</earliest> <latest>$lduration$</latest> <sampleRatio>1</sampleRatio> <progress> <condition match="'job.resultCount' == 0"> <set token="show">true</set> </condition> <condition> <unset token="show"></unset> </condition> </progress> </search> <option name="colorBy">value</option> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option> <option name="rangeValues">[0,10]</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> </single> </panel> <panel depends="$show1$"> <single> <title>Panel1</title> <search> <query>sarch_queryt</query> <earliest>$eduration$</earliest> <latest>$lduration$</latest> <sampleRatio>1</sampleRatio> <progress> <condition match="'job.resultCount' == 0"> <set token="show1">true</set> </condition> <condition> <unset token="show1"></unset> </condition> </progress> </search> <option name="colorBy">value</option> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option> <option name="rangeValues">[0,10]</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> </single> </panel> <panel depends="$show2$"> <single> <title>Panel3</title> <search> <query>sarch_queryt</query> <earliest>$eduration$</earliest> <latest>$lduration$</latest> <sampleRatio>1</sampleRatio> <progress> <condition match="'job.resultCount' == 0"> <set token="show2">true</set> </condition> <condition> <unset token="show2"></unset> </condition> </progress> </search> <option name="colorBy">value</option> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option> <option name="rangeValues">[0,10]</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> </single> </panel> </row> </dashboard>  

I have looked for solutions but I have mostly found results regarding only current and past time comparison which is not what I need. I have a query that bins _time by 24h spans over the previous 7 days. and calculates a numeric value associated with those time spans. What I need is to compare each day's values to the entire week's and find any time period (so 48h) where the number jumped significantly.  An example of something similar to my my code: index=sandwiches saved_search_name="yum" earliest=-7d | bin span=24h _time | search sandwich_type="PB&J" | stats count by total_bread_type _time | stats sum(total_bread_type) as bread by _time | eval bread = round(bread / 10000, 2) currently the results are like this: _time bread 2021-12-22 18:00 22 2021-12-23 18:00 23 2021-12-24 18:00 21 2021-12-25 18:00 47 2021-12-26 18:00 48 2021-12-27 18:00 46 2021-12-28 18:00 47 Basically I am looking to compare the 'bread' values by _time and figure out if/where there is a jump of 10 or more and return that data. Any insight would be appreciated. Thanks!