Awesome! ... View more

Hello hello! I think what you are looking for here is the `transaction` command, but it can have some extra over-head.  I'll leave some examples here to see if they work for you. Since your requirement is simple, I suggest using the `stats` command instead of `transaction`. If you wanted to look at a specific EventID first and then another specific EventID after, `transaction` might be easier to implement. Version using `transaction`:   index=lalala source=lalala (EventID=4720 OR (EventID=4728 AND PrimaryGroupId IN (512,516,517,518,519))) | transaction UserName maxspan=5m | search EventID=4720 AND EventID=4728   Version using `stats`: index=lalala source=lalala (EventID=4720 OR (EventID=4728 AND PrimaryGroupId IN (512,516,517,518,519))) | stats values(EventID) AS EventIDs by UserName | search EventIDs=4720 EventIDs=4728 Edit: Fixing the code blocks. ... View more

I think @gcusello 's answer is the best scalable approach. If it's something quick and small, you could do something like this to keep it all in the SPL without needing a lookup:   index=brandprotection name IN (ali, ahmad, elias, moayad) | stats count BY name | append [| makeresults | eval name="ali, ahmad, elias, moayad" | eval name=split(name, ", ") | mvexpand name | eval count=0 | fields name count] | stats sum(count) AS count BY name   ... View more

This seems to be an limitation on the Microsoft end: https://learn.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj984335(v=office.15)?redirectedfrom=MSDN#data-granularity-persistence-and-availability   The `delay_throttle` option in the input can be used to control it, but the docs seem to say that events can be delayed by 24-hours in the Microsoft end, so that seems to be why the default is 24-hours. ... View more

Hi! I think you are referring to panels that can fold in the dashboard. I believe this has already been answered here: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-add-feature-expand-or-collapse-panel-in-dashboard-using/m-p/507211/highlight/true#M33722  ... View more

This is due to issues with load balancers sitting in front of the hosts. Check the stickiness of the load balancers. Accessing a SH member directly should solve it. ... View more