I'm trying to create a chart showing activity from May through until now, knowing that the activity ceased some months ago. I want the chart to continue  showing a flat line of zero from the time the activity stopped, rather than just stopping back in August. How would I tweak the following query to include the ceased traffic? earliest=05/01/2020:00:00:01 latest=now index=nix sourcetype="nix" src_user=JohnD host=server1  | bin _time span=1w | stats count by _time, host Thanks. ... View more

Hi, I'm indexing events in JSON format and I need a way of extracting into individual fields the values broken up by the pipe in the 'Subject' field seen below; RecipientAddress: bla@bla.com SenderAddress: fred@fred.com Size: 201828 Status: FilteredAsSpam Subject: 1|fdbe21c9-xxxxx|195.168.1.1|Comms@fred.com|([Ext]Hi, join us for the 10-year roundup) 12/11/2020 8:21:14 AM ToIP: null I seem to be struggling to get a regex to work, not sure whether I need to take into account the JSON formatting? Thanks. ... View more

Hi, How do I write a regex to capture whenever I see any combination of 10 digits followed by .zip within a _raw event? eg: url=www.abcdef.com/1234532419.zip Thanks. ... View more

Anything wrong with this join and subsearch? I know there are events which should match based on the 'cs_host' field. Not sure if the rename is confusing things, or my syntax is off slightly. index=aaa sourcetype=o365 "*phish URLs*" | rename zu as cs_host | join type=inner cs_host [ | search index=bbb sourcetype="proxy_logs" | fields *] | stats count by cs_host Appreciate any ideas. ... View more

Hi, Whats the correct syntax to use when trying to return results where two fields DO NOT match? Trying the following, but not within any great success; | where NOT match(field A, field B) Thanks. ... View more

Is it possible to take a distinct count of something, then list this by an additional value by day? something like the following but tweaked to display the count of events, by urgency on specific days; notable | bucket _time span=1d | stats dc(event_id) by urgency, _time The goal being a table that looks like the following; Monday Medium, 5 High, 7 Tuesday Low, 6 Medium, 10 High, 20 etc etc Thanks. ... View more

Is there a way to return a specific value if an event is seen between 18:00 and 07:00 the following day? I need to generate a different value if something occurs overnight. Was originally thinking of an eval with a > than, but then 02:00 would be less than 11pm so I'm confused as to whether it's possible! Thanks. ... View more