Try this: | chart count over country by action | addtotals fieldname="Total Requests" | eval "% Blocked"=tostring(round((blocked/'Total Requests'*100), 2))."%" ... View more

When you say you want to pass a parameter to a report, what do you mean? Generally, I've used drilldowns to pass parameters to forms on dashboards. Are you loading the saved report in the context of another dashboard? ... View more

Ok, if you only want to match on values in events with ssl_subject= , then this should do it: ssl_subject\="(CN=(?<CN>[^=]*))?(C=(?<C>[^=]*))?(S=(?<S>[^=]*))?(O=(?<O>[^=]*))?(OU=(?<OU>[^=]*))?" ssl_start_time Here's a link to test: https://regex101.com/r/ZOyEIg/3 ... View more

I think this should give you what you're looking for: index=_audit "action=password change" | stats latest(_time) AS _time BY user | append [| rest /services/authentication/users splunk_server=local | fields title roles realname email | rename title as user | rename realname as name ] | stats latest(_time) AS _time values(roles) AS roles values(name) AS name values(email) AS email BY user | where isnull(_time) OR (_time<relative_time(now(), "-30d@d") AND like(roles, "admin")) The part before the append will find the latest time a user changed their password. The subsearch will gather the related user information for the whole user base. After that, a second stats call will find the latest _time value for each user (and also list their roles, name, and email). Because the subsearch returns data that does not contain _time values, the only users with non-null _time fields will be users who have changed their passwords sometime during the search time. So if you make the search time 3 months, users who've changed their passwords in the last 3 months will be removed by the | where isnull(_time) , and the second half of this clause looks for users with "admin" in their list of roles and checks to see if their most recent password change time is earlier than 30 days prior to now. ... View more

Yup! Sure is. ... View more

It doesn't look like the search was even launched. You did click to start the search, right? What happens if you try removing the final stats command, as I suggested in my post? Can you show what that returns? ... View more

I'm not an expert in this, so this might not be the solution, but have you tried moving the base search higher in the file so that it's defined before the item post-processing it is called? ... View more

In the meantime, you could try the following searches to see if they are showing you what you want: index=wineventlog EventCode=521 OR EventCode=4617 | bin span=1h _time | stats count by _time, host or index=wineventlog EventCode=521 OR EventCode=4617 | bin span=1h _time | chart count by _time, host ... View more

Are you trying to make a search you can schedule to run once every hour and alert if the total count of events in that hour for a given host exceeds a threshold? Or do you want to make a table of host many events per host were seen each hour and then only retain the rows where the count exceeded a threshold? It would help a lot to know your end goal. ... View more

Assuming your logs are formatted exactly as posted, this should do it for you: |eval time=strptime(timestamp, "%m-%d-%Y %H") | stats count by action, time | stats avg(count) AS Total_Average_Per_Hour by action It parses the timestamp with granularity down to the hour, counts the number of events per [action:hour] pairing, then calculates the average per action. ... View more

Here's a revision that I think should work: ("|\s)(?<key>(CN|C|O|OU|S))=(?<value>[^=\"]+)(?=(\s|")) ... View more

Ah, sure. Sorry. Here's a fix: | tstats count where index=* by host, _time span=1d | eventstats avg(count) as avg stdev(count) as stdev by host | eval lowerBound=(avg-stdev*exact(2)), upperBound=(avg+stdev*exact(2)) | eval isOutlier=if(count < lowerBound OR count > upperBound, 1, 0) | where isOutlier=1 AND _time>=relative_time(now(), "-1d@d") AND _time<relative_time(now(), "@d") ... View more

Create an alert, and use this search: index=main sourcetype=linux_secure user="x" | transaction pid startswith="session opened" endswith="session closed" | where duration>2 | table _time user duration Set it to trigger a notification if the number of events is greater than 0. ... View more

Personally, I'd schedule the alert to run every 15 minutes of every day and then create a macro called ignore_maintenance_window . The macro code would look like this: eval is_sunday=if(tonumber(strftime(now(), "%w"))=0, 1, 0), is_blocked_time=if(tonumber(strftime(now(), "%H"))>=1 AND tonumber(strftime(now(), "%H"))<=6, 1, 0) | search is_sunday=0 OR is_blocked_time=0 | fields - is_sunday is_blocked_time This macro will apply to every event two fields is_sunday and is_blocked_time , and the value will be the same for every event, because it's looking at the current time, not the time of the event. It will then filter out all events that are marked as is_sunday=1 and is_blocked_time=1 , so assuming your alert will only generate notification if event count is greater than 0, then this will prevent the alert from firing during the maintenance window. You'd apply it like this: your base search | `ignore_maintenance_window` ... View more

Honestly, I've never used the Machine Learning Toolkit, so I can't tell you. If you want to get some answers to that, I'd recommend a new post with that specific question - otherwise, this conversation will likely get buried. ... View more

This should do what you're looking for: sourcetype=amc environment=* | stats count AS repeat_count BY environment nodename | sort 0 - environment repeat_count | streamstats count AS top_count BY environment | where top_count<=5 | fields environment nodename repeat_count After generating the repeat_count value, it sorts all the values within each environment category by repeat_count . It then uses streamstats to generate a top_count value within each environment category. It filters out events with a top_count value greater than 5 (preserving only the top 5), and then organizes the fields as you displayed them. ... View more

Hey @amir_thales - Based on what I'm reading here and what I remember/understand from your other post, I'm going to suggest this: sourcetype="linux_audit" | transaction startswith="type=SYSCALL" endswith="type=PATH" | convert timeformat="%d/%m/%Y %H:%M:%S" ctime(_time) AS c_time | stats latest(c_time) AS Umount, count BY name | rename name AS usb_key | append [ sourcetype="mtab_executer" OR source="unix:useraccounts" | rex max_match=0 "(^|\n)(?<usb_key>\/\S+\s\/\S+)" | eval user_id=coalesce(user_id, uid) | eventstats latest(user) AS user BY user_id | convert timeformat="%d/%m/%Y %H:%M:%S" ctime(_time) AS c_time | stats latest(c_time) AS Mount, latest(user) AS user, latest(user_id) AS user_id, count BY usb_key] | stats latest(Mount) AS Mount, latest(user) AS user, latest(user_id) AS user_id, latest(Umount) AS Umount, sum(count) AS count BY usb_key If that doesn't return what you're looking for, I'd recommend stripping off that final stats call and see if the appended results look like what you expect. I'm pretty sure name in the first search represents the link to usb_key in the second search, and I've deliberately reversed the order of searches, because transaction is an expensive command that's more likely to time out (making it a bad candidate for a subsearch). ... View more

Can you share the XML code for that panel? Is it trying to load a report or use the loadjob command? Or is it using a base search and a post-processing search, maybe? ... View more

Glad we got it sorted! ... View more

Thanks, but I'm guessing you were trying to tag @Valisha2005 on this, since it wasn't my question. So @Valisha2005 - if either of our answers solved your problem, please accept one to help others. 🙂 ... View more

BTW, I apologize but I had a typo in the eventstats line on my original post - it was a copy/paste error moving from my test environment to yours. I fixed it now, so you might give it another try. ... View more