I have two fields: DNS and DNS_Matched. The latter is a multi-value field. How can I see if a field value in DNS is in one  of the multi-value field in DNS_Matched? Example: DNS DNS_Matached host1 host1 host1-a host1-r host2 host2 host2-a host2-r ... View more

I have a field called DNS whos field values contain the hostname in the lookup. There is also another field called Identified_Host that has similar values. I will show the difference below: DNS Identified_Host host1.domain.com host1.domain.com host1-admin.domain.com host1.domain.com host1-mgt.domain.com host1.domain.com host2.domain.com host2.domain.com host2-admin.com host2.domain.com host2-mgt.admin.com host2.domain.com host3.domain.com host3.domain.com host3-admin.com host3.domain.com   From this example. it's shown that Indetified_Host is the main name of the host. I need to find out which hosts in Identified_Hosts have values in DNS with the same name but also end with -admin and/or -mgt.  ... View more

I have events that where hostnames  show up more than once and I would like to combine them. The fields available are DNS Host_Auth IP. There will be vents where the =DNS is the same but the Host_Auth will be null and the IPs will be different. How can I combine by DNS to show the Host_Auth value that is not null and shows by IPs of the combined DNS?  ... View more

I have a list of events that happened over the last couple of weeks but the will be appended as it will be ran each week. I would like to create a search to show the number week of the year corresponding with the event.  I was was thinking something like this, but it applies to all events regardless of the time stamp.    | eval Current_Week=tonumber(strftime(now(),"%V"))   I understand I need to add more to the eval command to compare time of the event.  ... View more

I have a table that has the following fields: IP Host_Auth _time  The _time field shows the time the host was authenticated against for the current week and the previous.  How can I compare the Host_Auth field from the last two results for the same host? If the value for Host_Auth for a particular IP was successful last week by not this week, how can I show that? Eample IP                        Host_Auth                         _time  1.1.1.1               Unix Successful             2023-04-23 00:00:00           1.1.1.1                Unix Successful            2023-04-16 00:00:00   2.2.2.2                Unix Failed                       2023-04-23 00:00:00  2.2.2.2                 Unix Successful            2023-04-16 00:00:00  ... View more

I'm trying to create a search using Qualys vulnerability scan data to find hosts that failed to be logged into that were success the previous week.  I've been trying to use this similar example  as a template but it doesn't quite get what I'm looking for.  For reference, the Qualys data does not have fields that say something regarding successful or failed authentication attempts - rather they use QIDs. QID  105015 - Windows Failed 105053 - Unix Failed  38307 - Unix Successful 70053- Windows Successful      ... View more

I'm pretty sure the answer to my question is regex but I'm not too savy with it.  I have a few values in an IP field formatted like the below example. How can I remove the [] , and ' and get each IP in its own event?  ['10.1.1.1', '10.2.2.2'] ... View more