Hi, I am using tstats to search the Network Datamodel for outbound SMB traffic (port 445) to external IP address ranges. Why are local IP ranges still appearing in my search results? Here is my syntax:     | tstats summariesonly=t fillnull_value="MISSING" count from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port="445" AND NOT All_Traffic.dest IN ("10.0.0.0/8","172.16.0.0/16","192.168.0.0/24") earliest=-15m latest=now by _time, All_Traffic.dest, All_Traffic.dest_port,All_Traffic.src, All_Traffic.src_port, All_Traffic.action, All_Traffic.bytes, index, sourcetype     Screenshot: I believe I have filtered them correctly, but hmm... ... View more

Dumb question I cannot find a simple answer to. 🤣 If I run a simple timechart search for 7 days, 30 days or 90 days -- How can I overlay the 7 day, 30 day or 90 day average line over the timechart? For example:     index=blah sourcetype=blah filter_term=blah | timechart span=1d count as daily_count       ... View more