@isoutamo  What kind of value do i put in index? ... View more

@isoutamo  A base query like this? :  source="General-linux-sql.log" sourcetype="Linux" ... View more

@isoutamo  These are the results i get after using your code: Is there a way to ensure that the backdoor values appear on the same line as the IP Addresses?   ... View more

@isoutamo  These are my events in text format: BACKDOOR MISC sm4ck attempt [Classification: ] [Priority: ]: {PROTOCOL} 75.93.73.179:58287 -> 1.227.5.72:25   BACKDOOR DeepThroat 3.1 Drive Info From Server <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 31.95.30.207:80  -> 10.10.50.16:100   BACKDOOR DeepThroat 3.1 Swap Mouse Buttons Client Request [Classification: ] [Priority: ]: {PROTOCOL} 198.15.21.160:58287 -> 158.170.160.216:25   BACKDOOR BackOrifice access [Classification: ] [Priority: ]: {PROTOCOL} 155.226.107.174:58287 -> 203.153.54.84:25   BACKDOOR MISC sm4ck attempt [Classification: ] [Priority: ]: {PROTOCOL} 75.93.73.179:58287 -> 1.227.5.72:25   BACKDOOR BackOrifice access <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 191.174.4.187:80  -> 10.10.50.26:100   BACKDOOR DeepThroat 3.1 All Window List Client Request <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 178.135.115.196:80  -> 10.10.50.234:100   BACKDOOR HackAttack 1.20 Connect <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 34.114.188.191:80  -> 10.10.50.126:100   Master's Paradise98 backdoor for Windows & from 192.168.34.6 to 10.10.18.60   BACKDOOR DeepThroat 3.1 E-Mail Info Client Request <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 218.224.198.5:80  -> 10.10.50.167:100   BACKDOOR DeepThroat 3.1 Server Password Change Client Request <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 20.75.220.146:80  -> 10.10.50.41:100   BACKDOOR DeepThroat 3.1 Run Program Normal Client Request [Classification: ] [Priority: ]: {PROTOCOL} 103.63.71.129:58287 -> 155.32.118.92:25   BACKDOOR Doly 2.0 access [Classification: ] [Priority: ]: {PROTOCOL} 237.194.170.123:58287 -> 9.208.133.84:25   BACKDOOR HackAttack 1.20 Connect <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 34.114.188.191:80  -> 10.10.50.126:100         AOL Admin backdoor for Windows and AOL & from 207.125.33.2 to 10.10.18.50         Backdoor: HP OpenView hidden SNMP community & from 109.48.111.123 to 10.10.18.54   BACKDOOR DeepThroat 3.1 Swap Mouse Buttons Client Request [Classification: ] [Priority: ]: {PROTOCOL} 198.15.21.160:58287 -> 158.170.160.216:25   BACKDOOR DeepThroat 3.1 Hide/Show Start Button Client Request <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 9.83.177.135:80  -> 10.10.50.53:100   BACKDOOR DeepThroat 3.1 Server Active on Network <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 1.68.247.43:80  -> 10.10.50.218:100   Master's Paradise98 backdoor for Windows & from 192.168.34.6 to 10.10.18.6   BACKDOOR DeepThroat 3.1 Resolution Change Client Request [Classification: ] [Priority: ]: {PROTOCOL} 72.3.15.96:58287 -> 26.211.133.37:25   BACKDOOR MISC linux rootkit attempt <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 23.173.136.97:80  -> 10.10.50.33:100   BACKDOOR BackOrifice access <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 191.174.4.187:80  -> 10.10.50.26:100   BACKDOOR Doly 2.0 access <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 168.248.174.125:80  -> 10.10.50.20:100   I only need to extract the backdoor names and IP address which are highlighted in red. ... View more

@richgalloway  This is my sample data in text format: Apr 23 14:13:35 [143.5.113.3] snort[1976]: [1:729:1]  Virus - Possible scr Worm <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 37.236.185.162:80  -> 10.10.50.218:100   Apr 23 14:13:35 [143.5.113.3] snort[1976]: [1:779:1]  Virus - Possible NewApt.Worm - gadget.exe <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 161.38.138.124:80  -> 10.10.50.85:100   Apr 23 14:13:35 [143.5.113.3] snort[1976]: [1:757:1]  Virus - Possible Y2K Zelu Trojan <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 187.226.150.129:80  -> 10.10.50.102:100   Apr 23 14:13:35 [143.5.113.3] snort: [1:767:1]  Virus - Possible NewApt.Worm - baby.exe [Classification: ] [Priority: ]: {PROTOCOL} 222.190.104.160:58287 -> 26.73.78.96:25   Apr 23 14:13:35 [143.5.113.3] snort[1976]: [1:727:1]  Virus - Possible MyRomeo Worm <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 149.170.61.35:80  -> 10.10.50.154:100   Apr 23 14:13:35 [143.5.113.3] snort[1976]: [1:800:1]  Virus - Possible Resume Worm <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 234.87.141.144:80  -> 10.10.50.17:100   Apr 23 14:13:35 [143.5.113.3] snort: [1:801:1]  Virus - Possible Worm - doc.vbs file [Classification: ] [Priority: ]: {PROTOCOL} 240.81.210.240:58287 -> 66.56.229.39:25   Apr 23 14:13:35 [143.5.113.3] snort: [1:757:1]  Virus - Possible Y2K Zelu Trojan [Classification: ] [Priority: ]: {PROTOCOL} 60.151.205.115:58287 -> 110.244.14.35:25   Apr 23 14:13:50 [143.5.113.3] snort: [1:2266:1] VIRUS OUTBOUND .doc file attachment [Classification: ] [Priority: ]: {PROTOCOL} 234.182.233.181:58287 -> 0.235.220.175:25   Apr 23 14:13:39 [143.5.113.3] snort[1976]: [1:1234:1]  WEB-MISC VirusWall FtpSaveCSP access <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 192.69.129.252:80  -> 10.10.50.30:100   Apr 23 14:13:35 [143.5.113.3] snort: [1:730:1]  Virus - Possible shs Worm [Classification: ] [Priority: ]: {PROTOCOL} 145.134.206.152:58287 -> 112.8.113.14:25                Apr 23 14:13:35 [143.5.113.3] snort[1976]: [1:732:1]  Virus - Possible QAZ Worm Infection <\Device\Packet_{D3446BC6-343C-4C0C-8A29-AC6161C9D0F3}> TCP 36.75.150.0:80  -> 10.10.50.229:100   I only want to retrieve the virus names and IP addresses which are highlighted in red.   And this is my search query in text format: source="General-linux-sql.log" sourcetype="Linux" |rex field=_raw "Virus\s-\s(?<virus_name>.*)" | table virus_name | stats count by virus_name ... View more

@impurush  Is there a way for me to group them all into a table? ... View more

@isoutamo  I need to put the following line first as this is where i'll be retrieving my info from So do i add your code after this line? ... View more

@impurush  Hi. I just want to get "Possible NewApt.Worm - gadget.exe",  "Possible Y2K Zelu Trojan", and "Possible NewApt.Worm - baby.exe" ... View more

@thambisetty  Thank you for the solution ... View more

@bowesmana  I used this line in my panel search below | where match(User_Name,"$user_name$")     And i used the same token in my dropdown field so that i when i select the values from the dropdown field, it will appear in the panel.    When i cancelled the search in the dropdown function, i was supposed to get back all the user accounts with failed logins like this:   Instead, I got this:   How do i get rid of this error? ... View more

@anilchaithu  Thanks for the solution! However, now I have another problem with the Y-axis title. The title is now unreadable even though I changed it. Do you have any fix for this? ... View more

How do I display the time for each of the logins as well? ... View more