@jamie00171  - Thank Jamie. I am thinking to rerun my query with collect statement and removing the source type from there, so that it will default get saved into 'stash' sourcetype. My concern is, that particular summary-index already collects summary data from other searches. Will my SPL overwrite any of the existing fields ?   And after running my current query , how do I know that the data get stored in stash, Will I see the fields (from my SPL) get added into the interesting field side bar, and thats how I know it is now going to stash ? ... View more

index="secue" sourcetype="sec:json" attributes.meaningful_name!="" | rename "context_attributes.submitter.country" AS country | eval match_risk="Extreme" | lookup riskyNation.csv country_code AS country, Risk AS match_risk OUTPUTNEW Country AS risk_country | fillnull value=" " risk_country | rename "attributes.popular_threat_classification.popular_threat_name{}.value" AS threat_name | lookup flagged_threats.csv threat_name AS threat_name OUTPUTNEW flagged_threat | fillnull value=" " flagged_threat | stats sum("attributes.times_submitted") AS times_submitted, dc("attributes.md5") AS md5_count, values("attributes.md5") AS md5_value, values(risk_country) as risk_country, values(flagged_threat) AS flagged_threat by "attributes.meaningful_name", "context_attributes.submitter.id" | search md5_count > 1 | rename "context_attributes.submitter.id" AS submitter_id | rename "attributes.meaningful_name" AS meaningful_name | stats values(risk_country) AS extreme_risk_country, list(flagged_threat) AS flagged_threat, list(times_submitted) AS times_submitted, list(md5_count) AS unique_md5, list(meaningful_name) AS file_name, list(md5_value) as md5 by submitter_id ... View more

@gcusello  Such a neat idea. Thank you. I'll try that. ... View more

I noticed something, In my query if I write like this I get wrong iplocation data index=palo_alto_networks TERM(112.196.162.127) | table _time, sourcetype, src, local_ip Country user_name  | iplocation  src But if, I change the iplocation comands position to the middle , it gives the correct country data like this index=palo_alto_networks TERM(112.196.162.127) | iplocation  src | table _time, sourcetype, src, local_ip Country user_name  ... View more

I meant I can't open the file system in the standard way by using a command prompt and typing  btool debug command.  Lets say I want to see if there is any custom override for the TA Symantec. I write this in the splunk search bar to get the btool info.   index=splunk_admin sourcetype="an:1SPLK:config_file_btool_output_debug:txt" host="aws3e-bullcp0135.anz.net" "/opt/splunk/etc/apps/Splunk_TA_symantec-ep" and I see output like, /opt/splunk/etc/apps/Splunk_TA_symantec-ep/default/transforms.conf [symantec_ep_severity_lookup] /opt/splunk/etc/system/default/transforms.conf CAN_OPTIMIZE = True /opt/splunk/etc/system/default/transforms.conf CLEAN_KEYS = True /opt/splunk/etc/system/default/transforms.conf DEFAULT_VALUE = /opt/splunk/etc/system/default/transforms.conf DEPTH_LIMIT = 1000 /opt/splunk/etc/system/default/transforms.conf DEST_KEY = /opt/splunk/etc/system/default/transforms.conf FORMAT = /opt/splunk/etc/system/default/transforms.conf KEEP_EMPTY_VALS = False /opt/splunk/etc/system/default/transforms.conf LOOKAHEAD = 4096 /opt/splunk/etc/system/default/transforms.conf MATCH_LIMIT = 100000 /opt/splunk/etc/system/default/transforms.conf MV_ADD = False /opt/splunk/etc/system/default/transforms.conf REGEX = /opt/splunk/etc/system/default/transforms.conf SOURCE_KEY = _raw  Just because there is no etc/system/local   above and all are etc/system/default Can I say that there is no custom changes done to Symantec app? Note : my admin said something like, "all our apps are installed in ES(Enterprise Security) search head. and when updated are pushed from deployer it flattens both default as wells as local."   (I don't exactly understand what he meant.) ... View more

@Stefanie Would you happen to know if "Splunk Add-on for UEBA " app comes pre-installed with Splunk and whether it is active or deprecated ? ... View more

Thanks @Stefanie  for the response. Splunk_RapidDiag and Extreme Search are built into Splunk.  But when I see my Splunk Enterprise version it is 8.1.4, but RapidDiag and Extreme Search has version 1.4.0 and 2.4.4 respectively. ... View more

Changing the cron expression to what you suggested sorted out my problem. ... View more

I am really sorry for the confusion. I couldn't see the "throttle" option, then I realized, what I am looking at is not an 'Alert', but a "Scheduled Report".  Is there a way to suppress the email alerts from a 'Scheduled Report', please ? But I wonder why did I get so many triggered email for a ScheduledReport. I should get just one at the end of every 12 hour ! Is it because of the 'Scheduling Window' =5 min option that is messing it up ?   ... View more

Apart from changing the Cron Expression to  30 9,21 * * * and turning on throttle  suppress triggering to 11 hours, Is there anything else I have to change ? I am particularly thinking about Schedule Window = 5 Minutes.   Should I change it to anything ? What does the Schedule Window option do ? ... View more

That was brilliant . Thank you @ITWhisperer  for such lucid explanation. ... View more

index=web_short NOT uco_id=UCOAF NOT uco_id=HRX [ search index=phutan uco_id=PALTO source_zone=isp transport=tcp sourcetype="pan:threat" (source_location="Pacific" OR src_location="Stars Fed") (dest_ip!="179.45.143.47" threat_name!="TVS Vulneribility") severity!="informational" severity!="low" | eval source_ip_type=case( cidrmatch("184.31.77.0/24",source_ip),"UCO_src", true(),"unknown") | where source_ip_type="unknown" | stats count by source_ip | table source_ip | rename source_ip as search | format] The timestamp of the resulting events are between 7 Am to 8 Am 3/13/2022. But I don't see the events when I search with in the time rage 3/13/2022 6 Am to 10 Am I only see when I change the date time range between 3/13 to 3/14 OR 3/12 to 3/13  ... View more

@SanjayReddy  Thanks Sanjay, this helps. About the earliest=-1d  written in the inner SPL, does it mean , it will  force both the inner and outer query to run in the -1d time range , irrespective of the time range chosen in the search-bar ? ... View more

@SanjayReddy The field name is C_NAME in one SPL and  comp_name is another SPL, In that case will,  | join type=left C_NAME truly join the two data sets ? Just curious, my understanding could be wrong here ! ... View more