Hi @gcusello , my previous query didn't give any results, because was wrong. This is my new query: index=* "KeePass" | table src_user, src_user_email, src_ip, file_name | dedup src_user I need my query to show me the 'keepass' application and its version on each PC. With this query it only finds me the .exe, .dll, etc. files, but I need to know the version installed on each PC. Right now it correctly shows me "username", "password" and "IP" (although not everything, because I think there is some info missing in the raw file).
... View more