Hello,  The below search displays  _time in human readable format when count  of the results =1 but in EPOCH format when count > 1.   How can i get it to display _time value in  human readable format when count > 1 as well ?  Notice Rows number 2 ,4 and 5 in my results...     index=aws stats values(user_type), values(_time), values(eventName) count by user_name |rename values(*) as *     neerajs_81_0-1645010820666.png   ... View more

Hi All, I have the below search.  I am being told it appends results to a lookup table called user_ids.      index=ad earliest=-15d |stats latest(_time) as _time, latest(profile.department) as bunit, latest(profile.legacyUsername) as legacyUsername, latest(profile.userType) as category by userID | append [|inputlookup user_ids]   In all the posts i have seen so far, people recommend using outputlookup command to append   Can someone pls explain  how does append [|inputlookup user_identities]  end up appending  in my case ? How is this different than  | outputlookup append=true user_ids.csv  ... View more

Hi All, We have a saved search (snippet below) which populates a CSV lookup file.  The search is scheduled to run daily.     index=xyz ... | stats latest(_time) as _time, latest(legacyUsername), latest(title), latest(email), latest(endDate), latest(firstname), latest(lastname), by identity | rename latest(*) as * | eval identity = identity+"|"+email+"|"+legacyUsername   What's happening is,  every time the search  runs it creates duplicates as in each subsequent row appends the  results from the previous row to it for the "Identity" column as shown below.   I get that my "eval identity" command is making it do it.  But how can i make it not create new records if the "identity" already exists once in the table?   Hope i am clear.   I tried "Dedup identity" that didn't work.    Result:  Identity time legacyuserName title email enddata first lastname 1001|[email protected]|karen_woo xx xxxx xxx xxx xx Karen Woo 1001|[email protected]|karen_woo |[email protected]|karen_woo  xx xxxx xxx xxx xx Karen Woo 1001|[email protected]|karen_woo |[email protected]|karen_woo |[email protected]|karen_woo  xx xxxx xxx xxx xx Karen Woo 1001|[email protected]|karen_woo|[email protected]|karen_woo |[email protected]|karen_woo|[email protected]|karen_woo |[email protected]|karen_woo         xx Karen Woo ... View more

Hello,   I am using the below query to output which of our Searches/Rules are mapped to which Mitre Technique IDs.   | inputlookup mitre_all_rule_technique_lookup | `lookup_technique_tactic_from_rule_name` | search rule_disabled=0 | dedup rule_name, technique_id, rule_disabled   The Result is as follows: rule_name tactic_ID tactic_name Technique_ID Tecnique_name Rule001 TA001 Persistence T1136 Create Account Rule001 TA002 Persistence T1098 Account Manipulation Rule001 TA008 Defense Evasion Txxxx Modify infrastructrue   As you can see ,  it is showing different entries for  the same data in the "rule_name" column .   The Rule mentioned in the Rule_name column is mapped to 3 different Tactic_ID ,Technique_IDs etc which is why  it shows 3 results for the same rule.  How can i consolidate all this ? Basically this is the output i want : rule_name tactic_ID tactic_name Technique_ID Technique_name Rule001 TA001 TA002 TA008 Persistence Persistence Defense Evasion T1136 T1098 TXXXX Create Account Account Manipulation Modify infrastructure Rule002 TAxxx TAXXX .... ..... ......           If i change my dedup command in the query  to:   | dedup rule_name  ,  then it displays only the 1st row  of every rule_name and omits the remaining values. Pls advise. I am sure this is something very fundamental. ... View more