How do I compare the values of the most recent event to the event before that and show only the difference? In one example, I am looking at o365 management activity with multivalue fields. I want to see the difference and know when a domain has been added to an inbound Spam Policy. Here is my base search: index=idm_o365 sourcetype=o365:management:activity Workload="Exchange" Operation="Set-HostedContentFilterPolicy" | eval a=mvfind('Parameters{}.Name', "AllowedSenderDomains"), AllowedSenderDomains=mvindex('Parameters{}.Value', a) | table _time user_email ObjectId AllowedSenderDomains | sort - _time The last two events will be this: 2022-08-15 00:00:00 user@example.com SpamPolicyName A.com;B.com;C.com 2022-08-10 00:00:00 user@example.com SpamPolicyName A.com;B.com I would like to compare these two events and only show the difference, i.e. that "C.com" was added: 2022-08-15 00:00:00 user@example.com SpamPolicyName C.com ... View more

The answer to this probably stupid simple. Banging my head on this. Help and patience please.   I am writing a query which audits user role activations. A user can have many roles, i.e. Network Admin, Security Reader, User Admin, Storage Operator, etc. Specifically, I want to view how many days has passed since a user activated a specific role.   Today - Last Activation = Days Since Last Activation   Questions: How can I most efficiently subtract the time of the most recent role activation event from the current time? How can I then only show the most recent results? How to then audit all users who have not activated a role in the past 30 days?   Base query for a single user search over 30 days and sample results are below.    index=audit user=bob@example.com | eval days = round((now() - _time)/86400) | table Role, user, _time, days | sort - days Sample Data Below Role UserName _time days Global Reader bob@example.com 2021-09-19T08:35:06.998 29 Global Reader bob@example.com 2021-09-19T08:35:05.514 29 Systems Administrator bob@example.com 2021-09-23T05:55:51.177 25 Systems Administrator bob@example.com 2021-09-23T05:55:49.036 25 Global Reader bob@example.com 2021-09-24T00:48:20.254 24 Storage Operator bob@example.com 2021-09-24T00:48:18.942 24 Systems Administrator bob@example.com 2021-09-27T07:22:23.971 21 Systems Administrator bob@example.com 2021-09-27T07:22:22.971 21 Global Reader bob@example.com 2021-09-27T07:19:40.569 21 Global Reader bob@example.com 2021-09-27T07:19:39.460 21   Desired results only show the most recent events  Role UserName _time days Global Reader bob@example.com 2021-09-24T00:48:20.254 24 Storage Operator bob@example.com 2021-09-24T00:48:18.942 24 Systems Administrator bob@example.com 2021-09-27T07:22:22.971 21 Global Reader bob@example.com 2021-09-27T07:19:39.460 21 ... View more

Here is a basic tstats search I use to check network traffic.     | tstats summariesonly=t fillnull_value="MISSING" count from datamodel=Network_Traffic.All_Traffic where All_Traffic.src IN ("11.2.2.1","11.2.2.2","11.2.2.3") by All_Traffic.src, All_Traffic.dest, All_Traffic.action, All_Traffic.dest_port, All_Traffic.bytes, sourcetype | sort -count     I have a lookup file called "ip_ioc.csv" containing a single column of IPv4 addresses which constitute potential bad actors.   Instead of searching through a list of IP addresses as per above, I want the tstats search to check the lookup file. How can I modify the above search? Here is a terrible and incorrect attempt at what I am trying to perform:     | tstats count from datamodel=Network_Traffic.All_Traffic by All_Traffic.src, All_Traffic.dest, All_Traffic.action, All_Traffic.dest_port, All_Traffic.bytes, sourcetype | lookup ip_ioc.csv ip_ioc | where ip_ioc == All_Traffic.src OR ip_ioc == All_Traffic.dest       ... View more