Hi,   I am attempting to create a search for a password spraying attempt. I need the IP address and Hostname made with the different login names attempted to login to a particular machine within the last 5 min. Also, the number of login attempts should be more than 10.   I created the below search, but that's pulling me wrong data. A sample data am expecting is attached in the screenshot index=win* EventCode=4625 Logon_Type=3 Target_User_Name!="" src_ip!="-" |bucket span=5m _time |stats dc(TargetUserName) AS Unique_accounts values(TargetUserName) as tried_accounts by _time, src_ip Source_Workstation |eventstats avg(Unique_accounts) as global_avg, stdev(Unique_accounts) as global_std |eval upperBound=(comp_avg+comp_std*3) |eval isOutlier=if(Unique_accounts>10 and Unique_accounts>=upperBound, 1, 0) |sort -Unique_accounts   Thanks in advance. ... View more

How to ignore a field from search if the value is null, search based on the second input.? I have two inputs and this search will work only if i have some value in both the fields. I need the result, even if one value is null.   name="$field4$" OR EmpID="$field5$" Found a similar one here, but this did not resolve my issue. Appreciate the help in advance. https://community.splunk.com/t5/Getting-Data-In/How-to-omit-a-field-from-search-on-a-text-input-if-the-field-is/m-p/330788 ... View more