I'll try to explain it with a basic example. As an output of a stats command I have: detection query search1 google.com yahoo.com search2 google.com bing.com   I want to get which queries are not being detected by both search1 and search 2. Or else, getting rid of the queries that are in both searches, either way work. Like ok, search1 is detecting yahoo.com whereas search2 isn't, and viceversa with bing.com I thought about grouping by query instead of by search,  the problem is I have dozens or even hundreds of queries. Any thoughts? Cheers ... View more

We have a sample local ".txt" file to analyse some logs stored locally in the Heavy Forwarder, in its /tmp/ folder. For this purpose, a sourcetype has been configured in the Heavy Forwarder to parse the log as we wish. All this was set up from the web interface. Back in the day, we were wrong and created the index in the Heavy Forwarder to assign it from the "Input Settings" of the "Add Data" menu. But then we discovered that this should not be done this way. So, we created the index with name "test" in our cluster master and it was replicated correctly to the two peers indexers. The index is now created but with no information. And it does not appear in the Search Head. Unfortunately, when assigning the index where it should be saved from the menu Add Data of the Heavy Forwarder, the index "test" that is created in the Indexers does not appear. In addition, even when the index was created in both indexers and Heavy Forwaders the events wouldn't get to the indexers after selecting the "test" index. In that case it did appear on HF menu I guess because it was created locally there.   ... View more

In my HF, I parsed an example log from a local file and stored the parsing as a sourcetype. Then, I created an index for the events storage.  However, I cannot locate this in the Search Head after searching for it. I am uncertain as to whether or not the index exists in the indexer. There are two HFs, two Indexers, two Search Heads, and one Cluster Master/Deployment Server/ License Manager. The outputs.conf should be properly set, as more integrations are already operational. ... View more

For example, one field of the email data model is "recipient" and it comes from the tag=email. However, my email information comes from the Microsoft O365 integration, where the recipient information is given in a field called "ExchangeDetails.Recipients{}". As far as I have been able to understand, I have to modify the "email" tag, in "Event Types" to look in "index=o365 Workload=Exchange" for email related logs. And after that, I have to create an alias so that "ExchangeDetails.Recipients{}" is equivalent to "recipient" as indicated in the data model. Is that correct? Thank you for your assistance ... View more