Hi @D3mby, Based on @yuanliu solution, I followed another way. Below works with sample data. Could you please give it a try? You should adapt lookup lines and temp m_* variables according your count of management levels.  | inputlookup ldap_users.csv | eventstats values(cn) as underlings by manager | rename manager as m_3 | lookup ldap_users.csv cn as m_3 OUTPUT manager as m_2 | lookup ldap_users.csv cn as m_2 OUTPUT manager as m_1 | lookup ldap_users.csv cn as m_1 OUTPUT manager as m_0 | foreach m_* [ eval mng='<<FIELD>>' | eval managers=mvappend(managers,mng) ] | fields - m_* - mng - underlings | stats values(*) as * by managers | where managers!="-" ... View more

Hi @dionrivera, My confusion is why only Security events are affected. The first thing to check should have been the "thruput" setting but since your system events were working alright we didn't consider that option. Anyway, very nice to hear it is resolved.   ... View more

Hi @muradgh, In order to LINE_BREAKER work, you should use the line breaker setting below to fortigate_log  sourcetype on HF. [fortigate_log] SHOULD_LINEMERGE = false LINE_BREAKER = (\d{2,3}\s+<\d{2,3}>) TIME_PREFIX = eventtime= TIME_FORMAT = %s%9N This should work better but you may have similar problem again if Syslog-ng puts a new line. It is better to tell syslog-ng event boundaries to make it write one event per line. I don't have experience on syslog-ng that is why I don't know how to do it.  ... View more

Hi @sureshkumaar, monitor inputs are case-sensitive. Is it possible directory or filenames are not the same as \\A11FLSCOMMVAULT\commvault_reports\LISTAPAC\Backup* ? ... View more

Hİ @_pravin, Higher versions may need more resources in some cases but it is not easy what causes problems on your indexers. You can check on monitoring console Resource Usage for indexers. You can see which processes are using most of the resources.  ... View more

Hi @_pravin, It is a warning about low disk performance on indexer3. Either that indexer is too busy or your filesystem cannot provide enough IOPS. If your indexers are running on shared storage this may show the bottleneck.  You should better check your filesystem performance. ... View more

Hİ @finnpalm, Lookups work case-sensitive as default. That is why your "ASSET AS EndpointDeviceName"  may not match. If this is the case, you can change your lookup definition to case-insensitive.   ... View more

Hi @rasmirr, If your prod and test instances are the same you can use full backup/restore method. https://docs.splunk.com/Documentation/ITSI/4.16.0/Configure/FullBackup https://docs.splunk.com/Documentation/ITSI/4.16.0/Configure/Restore     ... View more

Hi, please try below; index=mail sender!="postmaster@groupncs.onmicrosoft.com" | lookup email_domain_whitelist domain AS RecipientDomain output domain as domain_match | where isnull(domain_match) | lookup all_email_provider_domains domain AS RecipientDomain output domain as domain_match2 | where isnotnull(domain_match2) | stats values(recipient) as recipient values(subject) as subject earliest(_time) AS "Earliest" latest(_time) AS "Latest" by RecipientDomain sender | where mvcount(recipient)=1 | eval subject_count=mvcount(subject) | sort - subject_count | convert ctime("Latest") | convert ctime("Earliest") ... View more

Hi @bhaskar5428, Please try below; index=* ("ORC from FCS completed" OR "ORC from SDS completed." OR "ORC from ROUTER completed") namespace IN ("dk1692-b","dk1399-b","dk1371-b") | eval dk1692=if(searchmatch("\"ORC from ROUTER completed\" namespace=dk1692-b"),1,0) | eval dk1399=if(searchmatch("\"ORC from SDS completed\" namespace=dk1399-b"),1,0) | eval dk1371=if(searchmatch("\"ORC from FCS completed\" namespace=dk1371-b"),1,0) | stats sum(dk*) as dk* | search dk1692>90 OR dk1399>60 OR dk1371>60   ... View more

Please try below; index=mail sender!="postmaster@groupncs.onmicrosoft.com" | lookup email_domain_whitelist domain AS RecipientDomain output domain as domain_match | where isnull(domain_match) | lookup all_email_provider_domains domain AS RecipientDomain output domain as domain_match2 | where isnotnull(domain_match2) | stats first(_time) as firstTime latest(_time) as lastTime values(subject) as subject values(recipient) as recipient by sender | where mvcount(recipient)=1 | eval subject_count=mvcount(subject) | convert ctime(*Time) ... View more

Hi @bhaskar5428, Please try below two options, index=* ("ORC from FCS completed" OR "ORC from SDS completed." OR "ORC from ROUTER completed") namespace IN ("dk1692-b","dk1399-b","dk1371-b") or index=* "ORC from * completed" namespace IN ("dk1692-b","dk1399-b","dk1371-b") ... View more

Hi @garrywilmeth, It seems better to use your CSV files as a lookup. https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ConfigureCSVlookups   ... View more

Hi @garrywilmeth, You can use below search without join. index=your_index sourcetype=AAD_MSGraph_UserData OR sourcetype=AD_UserData | eval sid=coalesce(AAD_OnPremSID,AD_SID) | stats values(AAD_*) as * values(AD_LastLogon) as AD_LastLogon by AAD_OnPremSID | table AAD_OnPremSID AAD_Email AAD_UserType AAD_LastPWChange AAD_LastSignInDateTime AAD_LastNonInteractiveSignInDateTime AD_LastLogon   ... View more

Hi @revanthammineni, Your conditions are very similar but else values are overwriting. You can use below to give an idea. | eval score=if(searchmatch(insurance="Y" instate="Y" age_requirements="y" id!="N/A" risk="Critical" risk_factor="critical" ), 30, 60) | eval score=if(searchmatch(insurance="Y" instate="Y" age_requirements="y" id!="N/A" risk="Critical" risk_factor="high" ), 60, 90) ... View more

I didn't understand your question. Is your problem only for missing the DateTime field? That search does not give any output. Did you try my reply? It should show you what you want. Please be more specific. ... View more

Hi @sulaimancds, You can use mvcount() function to count recipients like below; index=mail sender!="postmaster@groupncs.onmicrosoft.com" | lookup email_domain_whitelist domain AS RecipientDomain output domain as domain_match | where isnull(domain_match) | lookup all_email_provider_domains domain AS RecipientDomain output domain as domain_match2 | where isnotnull(domain_match2) | stats values(recipient) as recipient values(subject) as subject earliest(_time) AS "Earliest" latest(_time) AS "Latest" count by RecipientDomain sender | where mvcount(recipient)=1 | sort -count | convert ctime("Latest") | convert ctime("Earliest")   ... View more

Hi @jkuppala, Did you put this config to the indexer or heavy forwarder that data first ingested? ... View more

Hi @minpd0309, It depends on indexes.conf configurations. The most critical parameters are below; indexes.conf tsidxWritingLevel = [1|2|3] 7.3.3 default is 1 9.0.2 default is 3 journalCompression = gzip|lz4|zstd 7.3.3 default is gzip 9.0.2 default is zstd  If you are using 9.0.2 defaults on your 7.3.3 you can try. But if not unfortunately you cannot copy. If parameters are the same,  it is better to try on a seperate test server first. ... View more