Thanks Sid - It worked for me. ... View more

| search "body.refundTenderType"=* | search "body.refundTenders{}.paymentType"=* | rename body.refundTenderType as "RefundTender" | rename body.refundTenders{}.paymentType as "RefundTenderPaymentType" | stats count AS Count BY RefundTender RefundTenderPaymentType, body.orderNumber add this here | eval Refund = RefundTender . "-" . RefundTenderPaymentType | table Refund , body.orderNumber | chart count by Refund Try this if it works ... View more

Thanks Sid! I am understanding it better now. However I have scheduled search ( running every hour) which creates output lookup file and from that I am drawing the trends now. The 7 days trends working fine. However I am not able to segregate the last 24hrs events ( mean I dont know how to filter last 24hrs events to draw the trend). Kindly help me how to filter the last 24hrs trend from overall lookup ( which contains 7 days data). Thanks in advance! ... View more

Well that is exciting @Mus I hope that would come soon 🙂 Cheers 🙂 ... View more

@daviess158 which is the field that will give you unique filename? Instead of writing the append (which will have subsearch limitation you can just bring the data from index for both Read and Write access index=windowslogindex EventCode=4663 AND Object_Type=File (Accesses="ReadData (or ListDirectory)" OR Accesses="WriteData (or AddFile)") Then if the file name fields is filename (provide the actual file name field based on your indexed data) for example you can get the Access Types using stats command. Finally through a search find out events which have both Read and Write access. | stats values(Accesses) as Accesses by filename | search Accesses="ReadData (or ListDirectory)" AND Accesses="WriteData (or AddFile)") Following is a run anywhere example based on Splunk's _internal index index=_internal sourcetype=splunkd component=* (log_level="WARN" OR log_level="ERROR") | stats values(log_level) as log_level by component | search log_level="WARN" AND Accesses="ERROR" ... View more