It will look like the following: index=YOURINDEXHERE | regex Commandline="(regex1|regex2.*regex3)"   But I could be wrong as I still don't know what sort of regex you want to write or what kind of string you want to match. Hope it helps anyway.   ... View more

Hi again, I couldn’t say. There are many ways to do it. If you can be a bit more specific about your regex I might be able to help more.  Translating Boolean operators to regex is not trivial and it is not what regex was designed for originally.  You can replicate an OR the way I told you earlier. You can replicate an AND by simply doing a second regex after the first one but also within the same regular expression assuming the text you want to match follows that order.  In summary, if you can give us an example of what you are trying to match we could probably help you a lot more.  ... View more

Hi @bosseres , You could try with the following: index=* | regex Commandline="(keyword1|keyword2)"   But if you can tell us exactly what sort of regex you want to implement we might be able to assist a bit more. Regards, Javier ... View more

Hi again @avoelk, So resuming where we left it here: https://community.splunk.com/t5/Splunk-Search/search-a-value-in-previous-time-period-and-add-to-current-count/m-p/566103, I would try the following (keep in mind there might be typos as I did not test this on any lab):     index=indexa licensecount=* earliest=-45d@d latest=now() | stats count(eval(if(_time >= relative_time(now(), "-30d@d"), 1, null())))) as basecount, count(eval(if(_time >= relative_time(now(), "-45d@d") AND _time < relative_time(now(), "-30d@d") AND match(subject, "detatched"), 1, null())))) as addcount by productid | eval totalcount = basecount + addcount | timechart span=1d count(totalcount) by productid   ... View more

Something like the below perhaps (not tested obviously so there might be typos): index=indexa action=allowed app=DNS dest="8.8.8.8" earliest=-2w@w latest=@w | bucket span=1w _time | eval mytime = if(_time=relative_time(now(), "-2w@w"), "last_week", "this_week") | eventstats max(logincount) as max_count by mytime | eval max_count_this_week=if(mytime="this_week", max_count, null()) | eventstats values(max_count_this_week) as max_count_this_week | eval user_this_week = if(logincount = max_count_this_week AND mytime="this_week", user, null()) | eventstats count by _time, user | eval final_count = if(user=user_this_week AND time="last_week", count+max_count_this_week, null()) | stats values(final_count) by user, mytime   Where you search across 2 weeks and create the variable mytime with two labels: "last_week" and "this_week" for readability. Then calculate the max logincount this week and the user with that logincount, which then use to calculate the final count based on the user this week but the time period being last week. The final stats is just to show you in tabular format. ... View more

Yes, kind of, the key is to do one thing at a time. Your friend is eventstats in this case. So taking your description above and doing this step by step: count the maximum login count within this week | eventstats max(logincount) as max_count  and show me the user (assuming there is a field called user in this case): | eval myuser = if(logincount = max_count, user, null()) then look how often this user logged in the week before | bucket span=1w _time | eventstats count(eval(if(user=myuser,1,null()))) as myuser_count by _time and add this amount to my current count.  This is the bit I don't get. Add it to which current count?   ... View more

Hi @avoelk ,   If you want to group by weeks then it might be easier to do something like:   index=indexa action=allowed app=DNS dest="8.8.8.8" earliest=-1w@w | bucket span=1w _time | stats count by _time | eventstats sum(count) as total_count   Or use timechart:   index=indexa action=allowed app=DNS dest="8.8.8.8" earliest=-1w@w | timechart span=1w count   Let me know if that works for you. Alternatively, if you want full weeks, then simply use:   earliest=-2w@w latest=@w   ... View more

Hola! ... View more

Hi @revanthammineni , assuming I understood your request correctly, then you first need to make sure all those use cases (correlation searches) are generating notable events in order to populate the notable index. After you do that, it should be as simple as creating another correlation search or even a traditional saved search that reads from index=notable and presents the information in the way you want. Then trigger an email and you are done. You could also use the notable macro and expand the tokens included within the drilldown fields in order to display a much more richer version of this daily report. Something like: earliest=-1d@d latest=@d `notable` | expandtoken rule_title, drilldown_name, rule_description   That you can run once a day and will include yesterday's notables. Let me know if that helps. Regards, J ... View more