Thanks gokadroid, I made a couple of adjustments and it is working great, thanks! index=mine shared_with=@ | rex max_match=0 field=shared_with "(^|, )(?[^@ ]+)@(?[^,]+)(,|$)" | table name, domain ... View more

Jan 22 20:06:12 ttjtsxj00 syslog[0233]: - - [Shirlene@2024 activity_type="Share" created_timestamp="2012-00-00D20:02:04" from_detect="0" inserted_timestamp="2012-00-00D20:02:09" instance="L006f51sf" object_type="File" service="secure" severity="informational" shared_with="mark@diohnasypmxzjic.com, bart@diohnasypmxzjic.com, arat@toshiko.com, ken.smith@toshiko.com, eva.@one.toshiko.com, randal@toshiko.com, libby@wh.toshiko.com, azzie.hailey@one.toshiko.com, amy@diohnasypmxzjic.com, loretta.mark@one.toshiko.com, zenaida@one.toshiko.com, cherrie@diohnasypmxzjic.com, marcy@diohnasypmxzjic.com, genny@diohnasypmxzjic.com" source="KAY" user="natalya.h.lisabeth@toshiko.com"] User shared Deandrea document domain and user data has been randomized ... View more

sourcetype=your source | iplocation SourceIP | stats count by SourceIP, City, Region, Country ... View more

That shows the exact same number as the distinct user, perhaps what I am trying to show is the average user count of the total distinct users over time. For instance if I have 1500 distinct users over 7 days, show the average user count for that time ... View more

IS your palo alto data model accelerated? If I recall correctly the app pulls data in from there using the tstats command ... View more

The first query worked like a charm. The second gave me an error "The arguments to the 'mvfilter' function are invalid." Thanks! I was WAY over thinking it ... View more

When I have tried using the above tstats I don't get all of my indexes/sourcetypes. When I use | eventcount summarize=false index=* index=_* | dedup index | fields index | map maxsearches=100 search=" | metadata type=sourcetypes index=\"$index$\" | eval index=\"$index$\"" | stats values(sourcetype) by index I get a list of all of them ... View more

Try using this regex | rex "(?i)(?P.\w+)\d+.\w+\s+\d+\s+(?:/[^/]*){4}" ... View more

I am trying to use a erex with several examples to do the same thing. http://docs.splunk.com/Documentation/Splunk/4.1.5/SearchReference/Erex ... View more

That works thanks!! ... View more

Sorry if this seems confusing. really what I need is to only show events that are greater than 100 in the total column. ... View more

Again I posted 2 seperate searches to show what I have tried, I dont run BOTH searches ... View more

the output looks like this: Source-----------------------Destination-----------------------------subtotal----------------Total 1.1.1.1 2.2.2.2 3 5 3.3.3.3 2 ... View more

that is actually two separate searches, It all got mushed together when I posted 🙂 ... View more

That search did give me the 3 columns, After playing with it some more and using some of your suggestions as a guideline this is what we came up with and it works perfectly sourcetype=mysearch myemail | top Name by Dst_Email_Domain limit=500 | stats list(Name), list(count), sum(count) by Dst_Email_Domain guess I was over thinking it earlier ... View more

all I get is a count of every instance of email domain (count of 1) and all other fields are blank, maybe I am substituting in the wrong place, I replaced step 3 with your latest ... View more

Didn't work, most of the fields in my table end up being blank that either gives me no results or just a value of 1 100 times ... View more

output looks something like this: (note im only 1 mo. into using splunk) the counts in the category column are the same for all domains, the total column seems to have the correct counts for the # of emails going out, but it does not match up with the category column. Email_Domain Category Count Total gmail.com customerbill 100 470 creditcard 50 Invoice 100 confidential 220 yahoo.com customerbill 100 250 creditcard 50 Invoice 100 hotmail.com customerbill 100 300 creditcard 50 Invoice 100 confidential 220 ... View more