I receive a new csv file every day in the following format: color  1/22/20 1/23/20 1/24/20 1/25/20 yellow     1                2                0                 5 green        0              2                4                  3 purple     7             200             5                   3   Column 1 is the color, the column to the right starts a date column.  Every day there will be a new column that is dated from the previous day.  Today is Jun 29, so the csv I received this morning has columns from 1/1/2020 through 6/28/2020, all with a number indicating how many code yellows, greens, purples (and several other colors) occurred on that day.   My search has started as: index="coded-colors" sourcetype="csv" | stats sum(*) by color Unfortunately, this chart isn't very good.  I get all my colors on the (line) chart, but instead of dates moving from left to right, there are on top of each other.  All the dates for yellow are stacked on top of each other, all the dates for red are stacked on top of each other, and the colors move from left to right. I'd like to have a nice line chart that has 1/1/2020 on the far left and the current date on the far right. I would like the "elevation" of the chart to be determined by the number of events for that day/date and colors.  What has me stumped is how to use the column names as they continually change and are the actual date. I have no control over the csv file I receive.  Arg.   Thank you in advance. R   ... View more

I have a log (IPs and user name altered): Time - ID - Command - Argument 2018-05-16T18:06:23.680096Z 225 Connect Access denied for user 'admin'@'214.76.36.55' (using password: YES) 2018-05-16T18:06:25.389937Z 226 Connect admin@214.76.36.55 on using TCP/IP 2018-05-16T18:06:25.390134Z 226 Connect Access denied for user 'admin'@'218.76.36.55' (using password: YES) 2018-05-16T18:15:49.136165Z 227 Connect ruff@205.181.75.173 on using TCP/IP 2018-05-16T18:15:49.213672Z 227 Query select @@version_comment limit 1 2018-05-16T18:15:52.691468Z 227 Quit I'd like to build a query that will show me any two lines that Line 1 has a "Connect" and the NEXT line has a "Query" 2018-05-16T18:06:25.390134Z 226 Connect Access denied for user 'admin'@'218.76.36.55' (using password: YES) 2018-05-16T18:15:49.136165Z 227 Connect ruff@205.181.75.173 on using TCP/IP Note, the 226 and 227 (ID) appear to be unique for each attempt, i.e. both 226's are related to the same connection, the 227, Connect, query and quit are all part of the same connection. Also, some of the lines are not formatted so nicely. I'm stumped!! Thanks in advance. ... View more

I'm trying to be less dependent on automated regex and learn more about doing my own regex for field extractions. I have have these fields from Snort (IP addresses have been modified): 12/27-13:46:30.535369 [**] [1:2019876:2] ET SCAN SSH BruteForce Tool with fake PUTTY version [**] [Classification: Detection of a Network Scan] [Priority: 3] {TCP} 100.31.116.39:35016 -> 172.20.16.2:22 12/27-13:34:12.027500 [**] [1:2500056:4184] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 30 [**] [Classification: Misc Attack] [Priority: 2] {TCP} 100.83.149.133:58061 -> 172.20.16.2:22 I'm trying to extract between the first [**] and the second [**] giving me: ET SCAN SSH BruteForce Tool with fake PUTTY version AND ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 29 The extract I put together is: ^\d{2}\/\d{2}-\d{2}:\d{2}:\d{2}\.\d{6}\s\s\[\*\*\]\s\[\d{1,3}:\d{2,7}:\d{1,4}\]\s(?P\D{15,75}\s)\[\*\*\] It works on everything that doesn't end in a number such as TCP group 30, approximately 10% of my alerts end in a number such as 30. I've tried everything I can think of. Any help would be greatly appreciated! ... View more

I have multiple columns: source address: saddr dest address: daddr times seen: times_seen destination port: dport latitude: slat longitude: slong My report data is presented as: saddr daddr dport times_seen slat slong saddr daddr 0 12 lat long saddr daddr 1 22 lat long saddr daddr 0 15 lat long saddr daddr 1 7 lat long I'd like to see on my geostats map each dport and how many times it was seen by lat and long on the bubble. I'm getting everything working except for the addition of the "times_seen" block. Anytime I try to evaluate or add the "times_seen" I either get no results or an error. I'm using: index="the_index" | geostats latitude=slat longitude=slong count by dport ... View more