Hi there, Just a quick question on the cluster map that is not really displaying what we are aiming for... We have a simple query which is then piped to iplocation then geostats as this:     query | iplocation myIP | geostats count by Country globallimit=0     We are trying to "regroup" items by Country, as it may seem obvious, but it is more difficult than expected. Here is an example of the output (guess geobin/lat/lon is messing with us): Blue canada is splitted into 2 locations, and USA in at least 4, we would like to have a cluster more or less like the chloromap. If we count by Country before geostats, it shows the expected result (in a table), but if we apply geostats it is splitted by location, any way to circumvent this ? We tried to use another iplocation prefix, and geostats count by myCountry, does not work either 😞   ... View more

Hi there, Got some pain with aggregating results from 2 queries, which seemed simple at first glance... Query 1:   sourcetype="xxxx" severity=medium OR severity=high OR severity=critical | timechart span=1d count by severity   Query 2:   sourcetype="yyyy" request_status=blocked violation_rating>=3 | eval severity=case(violation_rating=3,"medium",violation_rating=4,"high",violation_rating=5,"critical") | timechart span=1d count by severity     The 2 queries are producing same columns ( _time, critical, high, medium), but I find it fairly difficult to simply aggregate the results...   If you have any hints...   This is producing NULL values and the values in the output are not correct:   (sourcetype="yyyy" request_status=blocked violation_rating>=3) OR (sourcetype="xxxx" severity=medium OR severity=high OR severity=critical) | eval severity=case(violation_rating=3,"medium",violation_rating=4,"high",violation_rating=5,"critical") | timechart span=1d count by severity     ... View more

Hello Everyone, We are currently working on exchange logs (IIS), and trying to detect abnormal traffic from different countries for a unique user, which seemed fairly simple. The main problem is that, as we found out, most of Outlook for mobile data is proxied through Microsoft network (no comment on data security...), so it could come from several location for a single user (ireland, usa, etc). To set up the dashboard, we want to exclude (for now), every IP that cidr match the microsoft network (will do the same for other cloud providers). For this, we wanted a way to insert the networks in a lookup table and add a field to the search request if the IP is owned by a cloud provider. Here is an example of the MS network (might not be exhaustive though..): https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide Any idea  on how to: - Add simply all this garbage to a lookup file containing the networks + provider label (here Microsoft) - Make the lookup and then add a field if the ip is in the lookup table (like a field "Cloud based IP" which contains the Provider) As a result, we will be able to filter out Microsoft/Google/Amazon from the anomalies... Would help a lot, and hope it will help other that are trying to get a better understanding of external outlook connections.. ... View more

Hi there, I know it sound pretty easy, but I am stuck with a dashboard which splits the events by hours of the day, to see for example the amount of events on every hours (from 00h to 23h) My request is like that: index=_internal | convert timeformat="%H" ctime(_time) AS Hour | stats count by Hour | sort Hour | rename count as "SENT" Only problem with the request is that I am missing zero entries in the histogram, and I wanted to have always the 24 hours displayed (even with zero results). Any way to do this ? Hope it will help others ... View more

Hi there, I have a dashboard which splits the results by day of the week, to see for example the amount of events by Days (Monday, Tuesday, ...) My request is like that: myrequest | convert timeformat="%A" ctime(_time) AS Day | chart count by Day | rename count as "SENT" | eval wd=lower(Day) | eval sort_field=case(wd=="monday",1, wd=="tuesday",2, wd=="wednesday",3, wd=="thursday",4, wd=="friday",5, wd=="saturday",6 ,wd=="sunday",7) | sort sort_field | fields - sort_field, wd   Only problem with the request is that sometimes a day or two could be missing in the histogram (0 entries), and I wanted to have always the 7 days displayed (even with 0 results). Any way to do this ? Any help appreciated! (like a left join in SQL) ... View more

Hi there, Just a quick question as I am not familiar with some basic routines yet.. We use a "ms:iis:auto" to ingest a basic IIS log file (W3C formatted), nothing special except it is a sharepoint website. After some time, we looked at the data in splunk, and we see this (raw format):     192.168.2.72 GET /_vti_bin/client.svc/web/title - 443 0#.w|domain\login 192.168.52.48 Mozilla/5.0        After some research, it seems that IIS log file can also contain/encode claims (here it is "0#.w|"): https://social.technet.microsoft.com/wiki/contents/articles/13921.sharepoint-20102013-claims-encoding.aspx Is it possible to remove this claim (or even better map it), knowing it is not always present ? That would allow us to see the user field in the proper format in splunk and not: "0#w|domain\user" Have a good day, ... View more