I need help with the structure of this search index=indexname I need help with the structure of this search I would like to display the username, the group and the connection method |stats count by username, group, connection method |sort -count ... View more

I have a lookup file that contains a column for hostname, ip address and location.  I need a query that will check the lookup file and determine if the element is up or down and if it has or used "radius". |inputlookup filename | search (MESSAGE_TEXT="Radius") ... View more

I created the following query to check the status of ldap service but i was wonder if there a better query  tag=NAME "AuthenticationResult=Passed" "Authentication failed" NOT "Identity Groups" NOT "ExternalGroups=CN" | stats count by host | search count > 15   Eventually I would like to add this search to my dashboard  ... View more

index= name tag=name NOT "health-*" words="Authentication words" OR MESSAGE_TEXT="Authentication word" | stats count by host | table host,count ... View more

 Im currently using the query to find the cpu utilization for a few host but i want to see the average utilization per host  tag=name "CPU Utilization" | timechart span=15m max(SysStatsUtilizationCpu) by host limit=0   Any information would be helpful ... View more

I would like to create a indicator on PsExec’s use of the C$, ADMIN$, and/or IPC$ shares and identifying User Access Control (UAC) events 552 and 4648 are indicative of an attacker attempting to use the runas command or authenticate against a remote host as an alternative user, #privilegeEscalation. ... View more