Hi @ITWhisperer ,   How do i do that? Any steps pls. Thanks.     Regards, Siva Kumar ... View more

 Hi ITWhisperer | tstats latest(_time) as LatestEvent where index=waf_imperva by host 15 min time frame Host                      Count 10.30.168.10 1699663326   Why query below is not providing this result? My humble request for a struggling engineer, May I have your whatsup? | tstats latest(_time) as LatestEvent where index=* by index, host | eval LatestLog=strftime(LatestEvent,"%a %m/%d/%Y %H:%M:%S") | eval duration = now() - LatestEvent | eval timediff = tostring(duration, "duration") | lookup HostTreshold host | where duration > threshold | rename host as "src_host", index as "idx" | fields - LatestEvent | search NOT (index="cim_modactions" OR index="risk" OR index="audit_summary" OR index="threat_activity" OR index="endpoint_summary" OR index="summary" OR index="main" OR index="notable" OR index="notable_summary" OR index="mandiant") ... View more

Do i need to include the IP address?             ... View more

The query should have the result of index = waf_imperva. However, the result is not there. How to I ensure to include waf_imperva in the query or how do I troubleshoot why not there?  ... View more