Hello, I'm trying to create a dashboard with a statistics table that will show a list of domains/hosts 10 minutes before and after a user connected to a specific domain. i.e. A user connected to abc.com at 12pm EST on 4/7/2022. I want to be able to input the users ID and host (abc.com) into text fields and when I submit/search I want results to show (sorted by time) all of the domains/hosts the user went to 10 minutes before and leading up to abc.com as well as all of the domains/hosts after abc.com I am stuck and have tried different variations of the query below using sort and desc. I've gotten results however, they only show the specific host that was entered into the text field and not the other hosts around that searched host. This is what I've started with and as previously mentioned, I've tried altering it quite a few times: index=proxy userID=$user_id$ host=$host_id$ | table _time, userID, host, ip, | sort host span=10m, -host span=10m Any assistance is appreciated! ... View more

Learning about joins and sub searches. What's the following query executing and would there be a way to make it more efficient? index=old_indexstats count values(d) as d by username | join type=inner username [search index=new_index | stats count by username ] I believe it starts by searching and counting usernames in the new index however, am getting mixed up after that. ... View more

I have 2 sourcetypes, vpn & winevents, how do you write a single query to get winevents of the top 5 busiest machines of IP X (1 IP is used by many users). The vpn sourcetype contains both hostname & IP, while the winevents only contains the hostname. I'm assuming I'd utilize the append command and a sub search sourcetype=winevents | append [search sourcetype=vpn] | top limit=5  Any help is appreciated, thanks ... View more

Hello, I'm trying to put a query together to monitor/view emails being sent externally to a personal domain.  i.e. johnsmith@corporation.com  to john@smith.com  or johnsmith@personalbusiness.com  I'm not looking for external personal email addresses like johnsmith@gmail  or hotmail.com, etc. Specifically domains that have some correlation to the users name that appear to be a personal domain.  index=***this is a corp. email index*** (from_domain="corp.com" AND rcpt_domain="??????") Any help is appreciated! Thanks! ... View more