Thanks for the tip! ... View more

Pls accept the comment, so this query appears answered. ... View more

Then remove the eval line. Also I see I had one mistake that there was a < instead of a >. Now when I search for | makeresults count=1 | eval PatchPubDate=1543622400 | stats count(eval(PatchPubDate>relative_time(now(),"-30d@d"))) AS "Patch Available less than 30 days" count(eval(PatchPubDate<relative_time(now(),"-30d@d") AND PatchPubDate>relative_time(now(),"-60d@d"))) AS "Patch Available 30 to 60 days" then I get: Patch Available less than 30 days Patch Available 30 to 60 days 1 0 (1543622400 is epoch time for 2018-12-01.) ... View more

Great. Don't forget to close the question for accepting this as an answer. This will help any splunker with similar problem to know that the solution worked. ... View more

Just replace the "invalid" timestamp value with something else. E.g.: index=tenable | eval PatchPubDate=if(patchPubDate=-1, "unknown", strftime(patchPubDate,"%Y-%m-%d")) | stats by riskFactor,severity.id,pluginID,description,solution,pluginText,PatchPubDate,ip or if you still need it to be a timestamp, then: index=tenable | eval PatchPubDate=if(patchPubDate=-1, "1970-01-01", strftime(patchPubDate,"%Y-%m-%d")) | stats by riskFactor,severity.id,pluginID,description,solution,pluginText,PatchPubDate,ip ... View more

same for me... the clientip field is empty ... View more

awesome! Shout out to the Discovered Intelligence boys! Meta Woot is awesome! ... View more

You can frame the search with wild cards. Example: src_ip=10.1.2.[wcrd] for a /24 CIDR range or src_ip=10.7.[wcrd].[wcrd] for a /16 CIDR range, etc. [wcrd] = * (I was having trouble getting the * to show when using more than 1 in the IP addresses.) ... View more