I have below two JSON events where under "appliedConditionalAccessPolicies", in one event policy1 has results =failure and policy2 has results=notApplied. In the other event the values are reversed. Now I'm trying to get the event where the policy1 has the status="failure", it gives both the events   index=test | spath path="appliedConditionalAccessPolicies{}" | search "appliedConditionalAccessPolicies{}.displayName"="policy1" "appliedConditionalAccessPolicies{}.result"="failure"   I have below two JSON events where under "appliedConditionalAccessPolicies", in one event policy1 has results =failure and policy2 has results=notApplied. In the other event the values are reversed. Now I'm trying to get the event where the policy1 has the status="failure", it gives both the events index=test | spath path="appliedConditionalAccessPolicies{}" | search "appliedConditionalAccessPolicies{}.displayName"="policy1" "appliedConditionalAccessPolicies{}.result"="failure" It looks like Its searching within all the elements in the array. How can I ensure It searches both the conditions on each element of the array and return the event which has the element satisfying both the conditions. Events :   appDisplayName: App1 appId: aaaa-1111-111aeff-aad222221111 appliedConditionalAccessPolicies: [ { displayName: policy1 enforcedGrantControls: [ Block ] enforcedSessionControls: [ SignInFrequency ContinuousAccessEvaluation ] id: f111113-111-400c-a251-2123bbe4233e1 result: failure } { [-] displayName: policy2 enforcedGrantControls: [ [-] Block ] enforcedSessionControls: [ [-] ] id: sdsds-8c92-45ef-sdsds-c0b2e006d39b result: notApplied } ] appDisplayName: App1 appId: aaaa-1111-111aeff-aad222221111 appliedConditionalAccessPolicies: [ { displayName: policy1 enforcedGrantControls: [ Block ] enforcedSessionControls: [ SignInFrequency ContinuousAccessEvaluation ] id: f111113-111-400c-a251-2123bbe4233e1 result: notApplied } { [-] displayName: policy2 enforcedGrantControls: [ [-] Block ] enforcedSessionControls: [ [-] ] id: sdsds-8c92-45ef-sdsds-c0b2e006d39b result: failure } ]   ... View more

In the below dataset, there are two different ISPs for the user from their usual ones. NordVPN for John and Quadranet for Jill – but this search using anomalidetection is detecting only john’s but not Jill’s. Any idea why and what is the better way to detect the ISP outlier? source="isp_data2.csv"  index="test" sourcetype="csv" | anomalydetection "ISP" "EmailAddress" action=annotate | eval isOutlier = if(probable_cause != "", "1", "0") | table "ISP" "EmailAddress", probable_cause, isOutlier | sort 100000 probable_cause     EmailAddress ISP timestamp john@example.com Comcast 1/1/2020 john@example.com Comcast 1/2/2020 john@example.com Comcast 1/3/2020 john@example.com Comcast 1/4/2020 john@example.com Comcast 1/5/2020 john@example.com Comcast 1/6/2020 john@example.com Comcast 1/7/2020 john@example.com Comcast 1/8/2020 john@example.com Comcast 1/9/2020 john@example.com Comcast ######## john@example.com Comcast ######## john@example.com Comcast ######## john@example.com Comcast ######## john@example.com NordVPN ######## john@example.com Comcast ######## john@example.com Comcast ######## john@example.com Comcast ######## john@example.com Comcast ######## john@example.com Comcast ######## john@example.com Comcast ######## john@example.com Comcast ######## john@example.com Comcast ######## john@example.com Comcast ######## jill@example.com Spectrum 2/1/2020 jill@example.com Spectrum 2/2/2020 jill@example.com Spectrum 2/3/2020 jill@example.com Spectrum 2/4/2020 jill@example.com Spectrum 2/5/2020 jill@example.com Spectrum 2/6/2020 jill@example.com Spectrum 2/7/2020 jill@example.com Spectrum 2/8/2020 jill@example.com Spectrum 2/9/2020 jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Quadranet ######## jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Spectrum ######## jill@example.com Spectrum 3/1/2020 ... View more

If I have a search result which has a field named "Field1" and It has values like : This is Word1 now. This is Word2 now. This is WordX now. This is WordZ now. Below is the look up table for Words. Field1 Word1 Word2 Word3 Word4 Word5 Word6 How can I search so I get ONLY below results in the output because they contain "Word1" and "Word2"? This is Word1 now. This is Word2 now. ... View more