Where is the error? (index=paloalto sourcetype="pan:threat" action=allowed severity=critical src_interface="ethernet1/2.110") OR (index=trend sourcetype="deepsecurity-intrusion_prevention") | eval cs23=replace(cs1, "\"", "") | eval match=case("threat:cve" == cs23,"Yes","threat:cve" != cs23,"No") | stats count by match ... View more

Hello, I'm trying to use the search below but I only get 0 events. What Am I doing wrong? index=rapid7 sourcetype=* | eval site=coalesce(site, "") | eval asset=coalesce(asset_id, "") | search site=* status=Approved reason="Acceptable risk" | search [search index=rapid7 sourcetype="rapid7:nexpose:asset" | fields * | eval tag=coalesce(split(nexpose_tags,";"), "") | search tag="*" * vendor_product="*" site_id="*" pci_status="*" (hostname=* OR ip=* OR mac=*) | fields * | table asset_id hostname ip mac os site_name nexpose_tags os] | dedup site asset vulnerability_id | sort "Status" DESC | table status vulnerability_id title asset_id severity_score severity reason additional_comments submitted_by review_date review_comment expiration_date port key ... View more