Like this: index=sepm sourcetype=symantec:ep:traffic:file Action=Allowed [index=sepm sourcetype=symantec:ep:risk:file Risk_Name!="W32.Ackantta!Dr" Risk_Name!="Tracking Cookies" Risk_Name!="xCmdSvc" Risk_Name!="WS.Reputation.1" Risk_Name!="JS.Downloader" Source!="Scheduled Scan" (Category_type="*Virus" OR Category_type="Security Risk") | bucket span=20min _time as bucket_time| eval Bucket_Time=strftime(bucket_time,"%m/%d/%y %H:%M:%S") | stats dc(dest_ip) as Count values(dest_ip) as Infected_machns by Risk_Name Bucket_Time category | where Count > 4 | table Infected_machns | stats values(Infected_machns) AS src_ip] | stats dc(dest_ip) as Count2 by src_ip | where Count2 > 3 ... View more

You can see the logins from any device that logs the login data with usernames provided those logs are indexed by Splunk. If you need help building a search, then you should post some sample events that contain the login data from the various devices. ... View more

As with some of your other posts, it's a bit hard to give you a search when you just give us the name of an index and the name of a lookup. Hopefully you understand that that is very little to go on. So instead let's just talk about the process your search could use and then if you have more details you can share about the data, maybe we can help you actually write the search. A couple questions. Are you planning to run this search over the past minute? Or do you want to run it over a longer period of time but do your evaluations in a minute interval? That will affect how the search is done. Start with your base search, maybe just index=ips. But if there is some way to filter just the DNS queries up front, that's probably a good idea. In general, somewhere along the way that will need to happen, so I'm just going to assume it will be done here. If running over a longer period of time, Pipe to the the bucket command and set your span to 1 minute for _time Now pipe to stats to get a count by source address Next lookup the source address in your lookup file, assuming it will output some new field to indicate whether it was found? Now filter your events with where (based on the output field from previous step) to keep only those that have a count greater than 10 and in the badip list OR greater than 50 and not in the list Then do whatever you want with the results... ... View more

the search reference is the ultimate document for this - http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference quick reference guide - http://www.splunk.com/web_assets/pdfs/secure/Splunk_Quick_Reference_Guide.pdf there is a quick reference - http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/ListOfSearchCommands Particularly this commands by category - http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Commandsbycategory hope this helps... Best Regards, Sekar ... View more

what should i write if i need to put a time interval of within 30 mins? like ex: bucket span=30m _time(is this correct?) ... View more