| tstats allow_old_summaries=true summariesonly=t values(Web.dest_ip) as dest_ip, values(Web.http_referrer) as http_referrer, values(Web.http_user_agent) as http_user_agent, values(Web.url) as url, values(Web.user) as src_user from datamodel=Web where (Web.src=* OR Web.url=*) by _time Web.src, Web.url | `drop_dm_object_name("Web")` | rename Web.src as src_host | regex url= "^((?i)https?:\/\/)?\w{2,4}\.\w{2,6}:8080\/[a-zA-Z0-9]+\/.*?(?:-|\=|\?)" | append [search index=audit_digitalguardian sourcetype=digitalguardian:process Application_Full_Name=msiexec.exe Command_Line="*:8080*" src_host="raspberryrobin.local" | stats values(index) as index, values(sourcetype) as sourcetype, values(Command_Line) as cmdline, values(_raw) as payload by _time, src_host, url] ... View more