Yes, I went though this documents. My ask is if I want to write use cases for any Malware Detection / Authentication related issues, what are the rules or logics we can follow to get better results. We have any documentation or source for this.  ... View more

Hi @gcusello / Team, I'm searching for list of indexes using |tstats count where index=* sourcetype=log4j  by index sourcetype I got results with lot of indexes in my environment. How can I find out which Data model / Macro using these indexes ? Is there any way to find out where it's been using ? Thanks in advance.  ... View more

Hi @scelikok , I'm searching for list of indexes using |tstats count where index=* sourcetype=log4j  by index sourcetype I got results with lot of indexes in my environment. How can I find out which Data model / Macro using these indexes ? Is there any way to find out where it's been using ? Thanks in advance.   ... View more

Also , it would be a great help if you can suggest about undefined logs and what kind these are :  Feb 17 15:41:44 SyslogAlertForwarder: ....0;;; HTTP Host == 10.10.198.187:8080;;; HTTP Response Content Type == application/javascript Last-Modified: Tue, 26 Feb 2019 16:11:46 GMT;;; " cribl_pipe = uk_mnshost = undefinedids_type = networkindex = eits_ips_prod_ussource = tcp:9997sourcetype = mcafee:nsm   Feb 17 15:41:07 SyslogAlertForwarder: ...P Response Content Type == application/octet-stream;;; " cribl_pipe = uk_mnshost = undefinedids_type = networkindex = eits_ips_prod_ussource = tcp:9997sourcetype = mcafee:nsm ... View more

Please find the sample log :   Feb 17 00:12:22 SyslogAuditLogForwarder: time="2021-02-17 00:12:22 BRT" domain="Serasa" category="Sensor" signature="Deploying updates to "spobripsgw02"." action="Set Deployment" result="succeeded" user="Administrator" comment="N/A" delta="N/A" category = Sensorcribl_pipe = br_mnshost = 10.52.225.200ids_type = networkindex = eits_ips_prod_ussignature = Deploying updates tosource = tcp:9997sourcetype = mcafee:nsm ... View more

Hi scelikok These are mcafee nsm logs not  McAfee ePO Syslog ... View more

I don't think here i can extract fields , because it's a Intrusion detection system data model and we directly get mcafee logs from tcp:9997 ... View more

Tried in all search modes still the same issue, raw event is showing "action"  , but interesting filed it's not showing action field ... View more

yes searching in verbose mode   ... View more

Okay, I will explian it simple and short : I'm searching data for Index=abc for last 2 weeks of data and I can see index percentage value is 98% events.. If I split time intervals and search like index=abc for this week and last week I can see 100% events. So, my question here is when i search data for last 2 weeks 98% events are showing, if i split time intervals and search it's showing 100% events. If data is more and due to buckets policy for last 2 weeks is it showing as 98% or is there any reason?   ... View more

Even if there is delay in _time events are getting processing , Here issue is if we run search for 10 days for raw data count of <10lacks index value is showing 100 % ... If raw data count is >10 lacks then index value is showing <100%... How can I rectify this issue ?  we have to change limit.conf for data getting from tcp:9997 port or there any other way ? ... View more

field:: * worked , Thank You so much    ... View more

Yes, after using the same search like with "*field*" , still events are missing. Under filed value count it's showing 4lack+ events , but in search filed value is showing 8 events.  ... View more

What can be that max or min delay time in events which can impact these index percentage ? ... View more