Hi, I'm trying to rewrite a given query and then execute it. I need to do some complex lookups which can't be done with a regular macro then I thought about having a python command that will fetch the query and reconstruct it. The issue I'm having is how to execute the new query? I've tried with the SDK but the run time is much higher + the results return to the statistics page. I've tried to inject the query into a field and then use map but it also wasn't successful. Any idea that works? Maybe something I didn't try or whether if you know that one of that methods should work. Thanks. ... View more

Hi, I have a json of Sysmon logs. I want to load it locally to splunk enterprise but I faced some difficulties. I downloaded Splunk Add-on for Sysmon but have no idea what I should do next.   Thank you in advanced! ... View more