HI bowesmana,   Many thanks for this....I'll adapt your query string a bit to see if fits some other variations of how the logs arrive, but essentially, it is the structure/combination of SPL commands that you provided that should make it work.    Thanks again. ... View more

Hi! I have a similar issue. I want to check if a url classification of the proxy has changed. Could anybody explain exactly what was done in that search? I don't get it. In detail my issue is like: I have a url that is classified as malicious and all traffic to there is blocked. But maybe 2 or 3 days before the url wasn't classified as malicious and so users were able to get to the site. So I need a search which checks if the classification changed within the last few days.   Any ideas? ... View more