In your search, you need to escape your quotes, like this:  search="search index=list-service source=\"eventhub://sams-jupiter-prod-scus-logs-premium-1.servicebus.windows.net/list-service;\" \"kubernetes.namespace_name\"=\"list-service\" | stats dc(kubernetes.pod_name) as pod_count" or use single quotes around the search contents: search=‘search index=list-service source="eventhub://sams-jupiter-prod-scus-logs-premium-1.servicebus.windows.net/list-service;" "kubernetes.namespace_name”="list-service" | stats dc(kubernetes.pod_name) as pod_count’   ... View more

What do you mean “show if changes are made”? ... View more

Hey, Michael! All of this goes on the search head. The first search the lookup you would run “frequently,” that could be hourly, daily, whatever frequency you need. The time picker should overlap the last time you ran the search so as not to miss anything. The lookup just gives you when a user’s last login is. The last search determines “active” vs “inactive”, which I set to be 90 days—if you’ve not seen a user login in 90 days, consider them inactive. ... View more

How about: index=myidx type=groups | lookup groups.csv groupid OUTPUTNEW groupname | table _time groupid groupname ... View more

Then, are you sure you’ve stopped the jobs? ... View more

Have you opened a case with Support? ... View more

how about adding … | search dispatchState != “DONE” ... View more

leecholim - Please mark an answer as your solution once you’ve tried. ... View more

Use the rex command and have regex cut it down. | makeresults | eval foo=“11111_aaaa/ppppaaaa” | rex field=foo “^(?P<foo>[^\/]*)” This uses regex on the foo field to take everything from the beginning of that field until the “/“ and assign back to the field foo. ... View more

I’d need to see your indexes.conf to be sure, but I think you’re talking about frozenTimePeriodInSecs and either maxVolumeDataSizeMB or maxTotalDataSize MB.  For your sizing, whatever setting you used, if your index size is 4.8 GB out of 50 Gb, you’ve not hit that limits yet to trigger any bucket movement. For frozenTimePeriodInSecs, this is triggered for index buckets, not individual events. When the youngest event in a bucket is older than 90 days (in your case), then the bucket gets rolled to frozen. However, that means you can have events in an index older than 90 days, like your May 1 event (115 days), if the youngest event in the same bucket it’s in is younger than 90 days. Make sense? ... View more

Can you provide more information about your data? Generally, you could | timechart span=1d count(eval(result==“success”)) as successes count(eval(result==“failure”)) as failures to help you further, I’d need to know more.  ... View more

Replace line 2 with:     | rex field=user "^\S{3}\\\\\\\\(?P<user>[\s\S]+)"   or this gets you there, too: | rex field=user "\\\\\\\\(?P<user>[\s\S]+)" ... View more

Try this:   (index=index1 sourcetype=sourcetype1) OR (index=index2 sourcetype=sourcetype2) | eval user=replace(user,"xxx\\\\\\\\","") | rename user as User | stats values(Email) as Email values(HostName) as HostName values(HostIP) as HostIP values(FileName) as FileName values(Message) as Message by User     If you like it, please mark it as the Solution; if not, let me know what needs changed. ... View more

I’m suggesting you not use delimited-based field extraction. You have much more flexibility and control with regex-based. Then, you don’t the errors you mention.  ... View more

Go to Settings > Fields > Field transformations > New Field Transformation and add this: Save this. Then, go to Settings > Fields > Field extractions > New Field Extractions and as this: Try that and let me know how it’s working for you.  ... View more

How about this? props.conf [<your sourcetype>] REPORT-xmlext = field-extractor transforms.conf [field-extractor] REGEX = \"*([^\"]+)\":\"([^\"|:]*)\",*|\"(time_stamp)\":\"([^\"]+)|\"(uri)\":([^,]+) FORMAT = $1::$2 MV_ADD = true REPEAT_MATCH = true If you like it, please mark it as the solution.  Thank you!! ... View more

With the current simpleXML, you cannot use page anchors. However, you could use “depends” where clicking on values at the top of the page reveal the associated panel. Have a table at the top of the dashboard with the choices of panels as rows down or columns across. Use the drilldown functionality to set a token. The value of the token is used in subsequent panels, initially not visible, to make one of the panels visible, whichever depending on the value clicked at the top. ... View more

Please let me know if this works for you. You'd run the first search ("index=windows ...") as a scheduled search on a regular frequency (for example, every hour or every day) looking back over a slightly longer period of time. If you ran it daily, you might set the time picker to 2 days or, if every hour, to 2 hours. It will always grab the latest login, so overlap into previous searches will not give you wrong information. The settings in collections.conf and transforms.conf set up a kvstore collection named "last_login". You could make the same sort of lookup through Lookup Editor if you didn't have CLI access. Finally, the second search ("|inputlookup last_login ...") is the one to run to get your report of active and inactive users. collections.conf [last_login] accelerated_fields.userhash = {"user":1} transforms.conf [last_login] collection = last_login external_type = kvstore fields_list = _key,user,last_login,hash match_type = WILDCARD(user) Search to schedule regularly to populate the "last_login" lookup: index=windows source=WinEventLog:Security eventCode=4624 | stats latest(_time) as last_login by user | eval hash=md5(user) | lookup last_login hash OUTPUTNEW _key as _key | fields user,last_login,hash,_key | outputlookup last_login append=t Search to run to get a listing of active and inactive users: | inputlookup last_login | eval status = if(last_login < relative_time(now(),"-90d"),"inactive","active") | convert ctime (last_login) | table user last_login status That's it! If it works for you, please mark it as the solution to your question. ... View more

True. Let’s expand the solution, then: Instead of the “| where count=1”, you could do something like ‘| eval status=if(count>1, “active”,”inactive”)’ This, however, doesn’t completely address the issue. To get the fullest solution, you could create a lookup with columns “user” and “last_login”. Regular searches would update the lookup with the latest login time found. Then, your search would be against the lookup where “now()-last_login” > 90 days. ... View more

Same approach: index=windows source=WinEventLog:Security EventCode=4624 earliest=-90d | stats count by user | where count=1 ... View more

And each time you FTP the entire log file to the Windows log server or just the additions? ... View more

How about this: index=_audit sourcetype=audittrail CASE(action=login attempt) CASE(info=succeeded) earliest=-90d | stats count by user | where count=1 ... View more