I have a report that lists malware received by email that is part of a dashboard. Some months the list for each person can have dozens of events listed. Management would like to only show the latest 5 events for each person. I'm having difficulty finding a good way to accomplish this. Search: index="my_index" [| inputlookup InfoSec-avLookup.csv | rename emailaddress AS msg.parsedAddresses.to{}] final_module="av" final_action="discard" | rename msg.parsedAddresses.to{} AS To, envelope.from AS From, msg.header.subject AS Subject, filter.modules.av.virusNames{} AS Virus_Type | eval Time=strftime(_time,"%H:%M:%S %m/%d/%y") | stats count, list(From) as From, list(Subject) as Subject, list(Time) as Time, list(Virus_Type) as Virus_Type by To | search [| inputlookup InfoSec-avLookup.csv | rename emailaddress AS To] | sort -count | table Time,To,From,Subject,Virus_Type | head 5 Current Output: time - user1 - [email protected] - Subject1 - Virus_A time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_C time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_B time - user2 - [email protected] - Subject1 - Virus_A time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_C time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_B time - user3 - [email protected] - Subject1 - Virus_A time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_C time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_B I'd like to limit it to the latest 5 events by user time - user1 - [email protected] - Subject1 - Virus_A time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_C time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_B time - user2 - [email protected] - Subject1 - Virus_A time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_C time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_B time - user3 - [email protected] - Subject1 - Virus_A time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_C time -              - [email protected] - Subject1 - Virus_B time -              - [email protected] - Subject1 - Virus_B Any help greatly appreciated! Thank you!   ... View more

Hello, I'm building a report to list all phishing and malware threat detections by sender, classification, and threat url. The data contains two types of events "clicksAllowed" and "clicksBlocked". I want to add a list of recipients if their click was allowed "clicksAllowed" and I'm struggling with how to structure my query. I'm currently trying to do this with stats and eval (I thought about using subsearch too maybe), hopefully, I'm on the right track but I can't figure out how to show only the recipients who clicked while still showing counts of how many clicks were allowed and blocked. Current search (without who clicked): index=tap sourcetype="pp_tap_siem" classification IN (phish, malware) threatStatus=active | eval time=strftime(_time,"%m/%d/%y @ %H:%M:%S") | stats earliest(time) AS First_Seen, latest(time) AS Last_Seen count(eval(eventType="clicksPermitted")) AS Clicks_Permitted, count(eval(eventType="clicksBlocked")) AS Clicks_Blocked, values(threatURL) AS TAP_Link BY sender, classification, url | table First_Seen, Last_Seen, classification, sender, Clicks_Permitted, Clicks_Blocked, AT_Risk_Users, url, TAP_Link | sort -Last_Seen Output looks like: First_Seen Last_Seen classification sender Clicks_Permitted Clicks_Blocked  AT_Risk_Users url TAP_Link 03/14/23 @ 17:52:36 03/14/23 @ 17:52:36 phish [email protected] 1 1 list of 1 person here hxxp://baddomain.com hxxp://link_tothreatintel_webportal.com/uniqueguid 01/05/23 @ 12:34:44 01/05/23 @ 17:44:41 phish [email protected] 39 3 list of 39 people here hxxp://baddomain2.com hxxp://link_tothreatintel_webportal.com/uniqueguid 01/18/23 @ 15:43:20 02/16/23 @ 22:46:19 malware [email protected] 4 0 list of 4 people here hxxp://baddomain.com hxxp://link_tothreatintel_webportal.com/uniqueguid ... View more