Hi Tom, thank you very much for taking the time to reply to my post and for the guidance. Many thanks and kind regards Chris ... View more

Hi thank you for your reply. The issue which puzzles me, is that the Splunk documentation shows the following: *Let's say you've been running the following search, with a time range of the past year: eventtype=firewall | top src_ip This search gives you the top source ips for the past year, but it takes forever to run because it scans across your entire index each time. What you need to do is create a summary index that is composed of the top source IPs from the "firewall" event type. You can use the following search to build that summary index. You would schedule it to run on a daily basis, collecting the top src_ip values for only the previous 24 hours each time. The results of each daily search are added to an index named "summary": eventtype=firewall | sitop src_ip* then *Now, let's say you save this search with the name "Summary - firewall top src_ip" (all saved summary-index-populating searches should have names that identify them as such). After your summary index is populated with results, search and report against that summary index using a search that specifies the summary index and the name of the search that you used to populate it. For example, this is the search you would use to get the top source_ips over the past year: index=summary search_name="summary - firewall top src_ip" |top src_ip* So I've written my queries as such. Many thanks and kind regards Chris ... View more

Hi, I've looked into the situation again and although it was a scheduled report, I've now changed this and run the report immediately with the query: auditSource=nc detail.input=* | sitop detail.input but the dashboard doesn't up date. My apologies for the stupid query, but I'm relatively new to using Splunk. Many thanks and kind regards Chris ... View more

Hi, many thanks for taking the time to reply to my post. I'll take a look at the this and get back to you. ... View more

Hi @tom_frotscher, thank you for taking the time to reply to my post and for pointing out the error over the eventId. Kind regards Chris ... View more

Hi @pwmcity, many thanks for taking the time to reply to my post and for the solution. Kind regards. Chris ... View more

Hi @somesoni2, thank you very much for taking the time to reply to my post and for the clear explanation. Once again many thanks and kind regards Chris ... View more

Hi @ohlafi, I really appreciate you taking the time to reply to my post with a good explanation. Very much appreciated. Kind Regards Chris ... View more

Hi @richgalloway, thank you for taking the time to reply to my post and for the simple explanation. A great help! Kind regards Chris ... View more

Hi @bmacias84, many thanks for the confirmation. Kind Regards Chris ... View more

Hi @landen99 thank you veyr much. Kind Regards Chris ... View more

Hi @jeffland, many thanks and kind regards Chris ... View more

Thank you @Icrielaa, your code worked great. Many thanks and kind regards Chris ... View more

Hi, I have had a look at my raw data today and found that there was an error with the capitalisation of the 'Postcode' field, it should have been 'PostCode', so I've now been able to get the expression to work. I just want to thank all that have contributed and despite their frusrations, their help. Many thanks and kind regards Chris ... View more

Hi @landen99, thank you for taking the time to reply to my post and come back to me with this. Unfortuanetly, this doesn't extract the data and the 'address1' variable is blank. Many thanks and kind regards Chris ... View more