Hi We index the accesses made on a filer. For each action on a file, events are generated and indexed in Splunk. The copy of a file does not directly generate a "copy" event but the "Event.System.EventName" field consecutively takes the three values "Open Object", "Get Object Attributes", "Read Object". This corresponds to three events in Splunk with no real common fields. How to build a query that would identify this consecutive sequence of events to alert us of a file copy ? Maybe the streamstat command could be used but I can't figure out how. ... View more