Hello @akki2428, Check out the regex command: | makeresults | eval _raw="record has not been created for id x1IoGPTIBP,x1IoGPTIBP in DB" | regex _raw="record has not been created for id \w{10},\w{10} in DB" Somewhat more flexible, you could also extract the ID as new fields and filter on these fields: | makeresults | eval _raw="record has not been created for id x1IoGPTIBP,x1IoGPTIBP in DB" | rex field=_raw "record has not been created for id (?<id1>\w+),(?<id2>\w+) in DB" | eval len_id1=len(id1) | eval len_id2=len(id2) | search len_id1=10 len_id2=10 ... View more

Hello @johnteo I suggest you create an account on https://my.phantom.us/ Doing so, you will find the system requirements in the Splunk Phantom Installation Manual (found under Learn / Documentation). ... View more

It would be helpful if you could post some sample data. Does your data have the _time field? If you want a chart with time as the X-axis, then take a look at timechart. Try something like this: ... | eval fields=split(_raw," ") | eval pauses=mvindex(fields,8) | timechart span=1mon max(pauses) as Max_pause avg(pauses) as Avg_pause min(pauses) as Min_pause ... View more

Use strptime() to convert LAST_SEEN into a UNIX timestamp. Check this out. This will get all events which are less than 30 days old: | makeresults | eval LAST_SEEN="2019-06-07 09:12:40.0" | eval LAST_SEEN_EPOCH=strptime(LAST_SEEN, "%Y-%m-%d %H:%M:%S.%1N") | eval diff_seconds=now()-LAST_SEEN_EPOCH | where diff_seconds<60*60*24*30 ... View more

You should create a field extraction for the activityId field, so that it gets extracted automatically for all events. This way, you don't need the rex command in your search. You are right: You should use a subsearch for this: index="myIndex" host="firstHost" NOT [search index="myIndex" host="firstHost" "Request blocked because of blacklisted user" | table activityId] ... Alternatively, with the rex command (I improved the regex a little): index="myIndex" host="firstHost" | rex field=_raw "\|(?<activityId>[^\|]+)\|" | search NOT [search index="myIndex" host="firstHost" "Request blocked because of blacklisted user" | rex field=_raw "\|(?<activityId>[^\|]+)\|" | table activityId] ... This will filter all events in the base search which have a matching activityId in the subsearch. ... View more