Morning Splunk Gurus's, I wonder if you can solve a question I have? If an email is sent to you and the senders email address has been spoofed, if you click reply the address changes to a fake email address. How do I monitor exchange logs to say if the "From" field in the email email is not the same as the "Return-path" field then alert me ? X-Sender-Id - This is the real sender The "Reply To" header is presented to the end-user but the actual reply goes to a field called "Return-Path" Return Path: This field is what the mail server would use if the end-user chooses to reply to sender From: This is address from someone you know \ trust, the email address of the impersonated sender. I've been racking my brain trying to work this out, and would really appreciate any thoughts \ ideas you might have Cheers D ... View more

I have about 10 panels in a dashboard, in pairs side by side all looking at the previous 60 mins. As each panel is a defined \ fixed size with zero results, I have to scroll down the lower panels to check if they have results. Do any of you gurus know how I can have all panels in view, showing just the panel names (That way they will fit on one screen)? If a result appears it shows up, and when the 60 minutes has passed, the result disappears and the panel auto shrinks ? I've tried to limit the results to |head 2 (But the blank empty panel still stays at its default large size) If i get a result Im sure the panel would then go smaller but I need them all on the screen at once. Cheers fir any help ye can give. - D ... View more

Good Morning Out of interest I wondered if anyone had a Splunk Search, which clearly showed machines being mined as opposed to staff visiting sites with the word "CoinHive" in them? I ran a search for CoinHive and came across a number of events , but I need to be more accurate in my searching to get events which are actually effecting users. Can anyone suggest a search which will capture machines running the javaScript and so being effected ? Thanks David ... View more