ep_winevt_ms* - This index is mapped in Data Model Macros.   I want to exclude all other indexes in (ep_winevt_ms*) and take the count as 1 to know the unique indexes. @ITWhisperer  ... View more

@gcusello  SPL Used   index=test |rename client.userAgent.rawUserAgent as User_Agent client.geographicalContext.city as Src_City client.geographicalContext.state as src_state client.geographicalContext.country as src_country displayMessage as Threat_Description signature as Signature client.device as Client_Device client.userAgent.browser as Client_Browser | strcat "Outcome Reason: " outcome.reason ", Outcome Result: " outcome.result Outcome_Details | strcat "Source Country: " src_country ", Source State: " src_state Src_Details | eval period=if(_time>now()-86400,"Last 24 hours","Previous") | eventstats dc(period) AS period_count BY src_ip user | stats count values(period_count) AS period_count min(_time) as firstTime max(_time) as lastTime by src_ip user Signature Threat_Description Client_Device eventType Src_Details Src_City Outcome_Details User_Agent Client_Browser outcome.reason   ... View more

@gcusello  For all the results i am getting period_count=1.  Whereas only a few IP are used my user="*@xyz.com*" in the last 30 days. I want to particularly filter if, the IPs were used by user="*@xyz.com*".   ... View more

@gcusello Thanks for your help.   I tried all the changes in the SPL too. However, period_count is showing 1. Hence i am unable to filter in results. ... View more

@gcusello  index=test eventType IN (security.threat.detected, security.internal.threat.detected) |rename client.userAgent.rawUserAgent as User_Agent client.geographicalContext.city as Src_City client.geographicalContext.state as src_state client.geographicalContext.country as src_country displayMessage as Threat_Description signature as Signature client.device as Client_Device client.userAgent.browser as Client_Browser | stats count min(_time) as firstTime max(_time) as lastTime by src_ip user Signature Threat_Description Client_Device eventType Src_Details Src_City User_Agent Client_Browser ... View more

@richgalloway  No luck!  But I confirm there is no other files and settings. Command used : index=vmware | stats count by sourcetype Currently syslog is ingesting via universal forwarder. Current configuration input.conf [monitor:///opt/syslog/vmware/10.149.xx.xx/*-syslog.log] disabled = false host_segment = 4 index = vmware-vclog sourcetype = vclog initCrcLength = 2048 Props.conf [source::/opt/syslog/vmware/10.149.xx.xx/*] TRANSFORMS-null= setnull [vclog] LINE_BREAKER = ([\r\n]+)\<\d+\>\d SHOULD_LINEMERGE = false transforms.conf [setnull] REGEX = ^\w+\W DESK_KEY = queue FORMAT = nullQueue ... View more

@isoutamo  First line of the below log Y63......ends with /. Whereas third line y63....ends usually. Does this make change? 10.218.136.20 - - [30/Jun/2023:02:36:40 +0000] "GET /api/v2/runs/run-Y63d5qeBk3pDHpJZ/run-events?include=comment%2Cactor HTTP/1.1" 304 0 "https://terraform.srv.companyname.com.au/app/customer/workspaces/a00964-tfe-test-customer_infra_main/runs/run-Y63d5qeBk3pDHpJZ" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"   ... View more

@isoutamo      ... View more

@isoutamo  Other logs   10.218.136.20 - - [30/Jun/2023:02:36:37 +0000] "GET /api/v2/workspaces/ws-ukz9TnHNE9kN4eCa?include=agent_pool%2Ccurrent_configuration_version%2Ccurrent_run%2Ccurrent_state_version%2Clocked_by%2Creadme%2Coutputs HTTP/1.1" 304 0 "https://terraform.srv.companyname.com.au/app/customer/workspaces/a00ccc-tfe-dev02-customer_infra/runs/run-ACevPzmMTYE6UP5e" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" 10.218.136.20 - - [30/Jun/2023:02:36:40 +0000] "GET /api/v2/runs/run-Y63d5qeBk3pDHpJZ/run-events?include=comment%2Cactor HTTP/1.1" 304 0 "https://terraform.srv.companyname.com.au/app/customer/workspaces/a00964-tfe-test-customer_infra_main/runs/run-Y63d5qeBk3pDHpJZ" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"   ... View more

@isoutamo Still i am getting "\" at the end of the workspace_id results. ... View more

@isoutamo Thanks for your reply. Results for Workspace_name is fine. But workspace_id ends with a backslash. Can i get the result without \   ... View more

@gcusello @ITWhisperer  Though I gave | search duration <7+ condition, I am getting results other results. How to exclude the results within 7 days.   ... View more

@ITWhisperer @gcusello  I have new installs but the query is updating the latest time to all results and showing all the results. Here I need the installation that occurred over the past 7 days.   ... View more

@ITWhisperer @gcusello Tried using the queries. But no results. ... View more

@Taruchit  You are right. ... View more