Hello. I'm having some problem and I can't for the life of me figure out what goes wrong. I am running a search like this against two lookups (both lookup files has multiple columns): index=gateway EventIDValue=gateway-check EventStatus=success | lookup assets_and_users.csv USER AS SourceUserName, ASSET AS EndpointDeviceName OUTPUTNEW USER, ASSET | lookup computer_objects.csv own_asset AS EndpointDeviceName OUTPUTNEW own_asset | where isnotnull(USER) OR isnotnull(ASSET) OR isnotnull(own_asset) AND own_asset!=EndpointDeviceName The idea is to check for a certain number of assets and users previously seen in our environment with the assets_and_users.csv lookup, and filter out assets that are currently managed by us with the computer_objects.csv lookup, so that I can see activity from the previously seen assets and users as well as assets not previously seen and that are not managed by us. However the first iteration of the search looked like this: index=vpn EventIDValue=gateway-check EventStatus=success | lookup assets_and_users.csv USER AS SourceUserName OUTPUTNEW USER | lookup computer_objects.csv own_asset AS EndpointDeviceName OUTPUTNEW own_asset | where isnotnull(USER) OR isnotnull(own_asset) AND own_asset!=EndpointDeviceName and that version gave me a couple thousand events. However, once I added the asset part as seen in the top query I got three events which doesn't make sense. I should if anything get more events than the first iteration (bottom query). Can someone spot where it goes wrong?

index=mail sender!="postmaster@groupncs.onmicrosoft.com" | lookup email_domain_whitelist domain AS RecipientDomain output domain as domain_match | where isnull(domain_match) | lookup all_email_provider_domains domain AS RecipientDomain output domain as domain_match2 | where isnotnull(domain_match2) | stats values(recipient) values(subject) earliest(_time) AS "Earliest" latest(_time) AS "Latest" count by RecipientDomain sender | sort -count | convert ctime("Latest") | convert ctime("Earliest")   original command  above   modify command below    index=mail sender!="postmaster@groupncs.onmicrosoft.com" | lookup email_domain_whitelist domain AS RecipientDomain output domain as domain_match | where isnull(domain_match) | lookup all_email_provider_domains domain AS RecipientDomain output domain as domain_match2 | where isnotnull(domain_match2) | table sender recipient subject DateTime | sort recipent == 1 | where recipient == 1 | convert ctime(DateTime)     when  i use where, there is no results showing.  i only want to show results of a single recipient. if there are many do not show it .  

Hello, I am trying to match the start of a path in httpRequest.uri, as seen here: index=xyz source=xyz | spath "httpRequest.headers{}.value" | search "httpRequest.headers{}.value"="application/json" | spath "httpRequest.uri" | regex "^/public*" | stats count by "httpRequest.uri" | sort -count  Unfortunately, it isn't working. Can someone point out what I am doing wrong here? If I get rid of the caret, the regex works, but it matches anywhere within the field’s string value. I need to start from the beginning of the string. Thank you so much in advance!