Nice, thanks again!! ... View more

@nickhillscpl, how would I tabulate the number of hits against each category? ... View more

This is great @nickhillscpl. Thanks much ... View more

When I ran that I got no results and no errors. If I remove "transaction src" i see results but simply line-by-line per src. You asked about having every url reported. That is something that I can do without and simply do drilldowns after the report is generated, as I realize that there will be a huge number of URLs. ... View more

Sorry, the header should have stated "Generate report for top 10 web category usage" ... View more

Hey guys, this thread is a bit old but it's the only that came close to what I was looking for. So I ran this search with a little modification to match my domain name and basically came up with nothing. I tested it line-by-line and the only time I can get any results is when the following line is ommited: |ldapfilter domain=MyDomainName search="(&(Objectclass=groupPolicyContainer)(|(cn=$gpo_guid$)(displayName={}*)))" attrs="displayName" I am trying to get in my results, the name name of GPOs being created/modified/deleted, etc and who made the changes Please let me know if anyone has any solutions. Thanks ... View more

Hi richgalloway, what setting can I check to find out if I have the necessary configs in order to log Linux systems changes? ... View more

Good 2 know ... View more

David I awarded you 2 points. Hope that's a good reward. Not sure what the norm is. ... View more

Worked! Thanks for the assists!! ... View more

You are indeed correct. Earlier when I was writing the search I followed the auto-complete in the search bar which led me to that. I just changed that to windows_cpu_load_percent and I am now seeing results, even writing the search 2 different ways. I still need to dumb it down a little but the 2 below seem to work: index=oswinperf sourcetype="Perfmon:CPU" | bucket _time span=30m | eval Load=if(windows_cpu_load_percent>=90,"CRITICAL",if(windows_cpu_load_percent>=80,"WARNING","")) | table Load _time host windows_cpu_load_percent | sort - count windows_cpu_load_percent | dedup host | rename Load as severity I'm still trying to determine how to convert a decimal to a whole number in the percentage column. Any thoughts on this? ... View more

@DavidHourani, Thanks for the response to my question. Unfortunately I received the "no results" even after changing the Warning and Critical values to much lower numbers. ... View more

Edit: The second to last line here should read: I would like to convert the results in the "Value" field to actual percentages ... View more

So this looked great until I realized that the search did not complete. It actually crashed with the following error messages: "DAG Execution Exception: Search has been cancelled" "Search auto-canceled" When the search is run using a Relative Time of "Today" or 4 hours etc, the search completes with no errors. However, if it goes beyond that then it it fails. Could this have something to do with the following lines? | stats count values(_time) as time by src,dest,query | convert ctime(time) as time ... View more

This is great. Much better results and the search ran much faster. Thanks mayurr98 ... View more

@mayurr98, thanks for replying. So here is a small snippet of what the report looks like: src dest query _time count ip address ip address 0.122.168.192.in-addr.arpa 2019-11-20T11:01:29.366-0500 1 ip address ip address 1.219.46.130.in-addr.arpa 2019-11-20T11:06:26.186-0500 1 ip address ip address 101.248.223.199.in-addr.arpa 2019-11-20T11:04:32.154-0500 1 ip address ip address 114.219.46.130.in-addr.arpa 2019-11-20T11:15:58.810-0500 1 ip address ip address 123.200.159.162.in-addr.arpa 2019-11-20T11:15:43.689-0500 1 ip address ip address 123.36.79.45.in-addr.arpa 2019-11-20T11:15:40.626-0500 1 ip address ip address 142.208.169.198.in-addr.arpa 2019-11-20T11:15:40.805-0500 1 ip address ip address 150.63.29.193.in-addr.arpa 2019-11-20T11:15:42.015-0500 1 ip address ip address 183.219.46.130.in-addr.arpa 2019-11-20T11:15:58.318-0500 1 ip address ip address 43.219.46.130.in-addr.arpa 2019-11-20T11:15:58.561-0500 1 ip address ip address 43.219.46.130.in-addr.arpa 2019-11-20T12:15:58.561-0500 1 ip address ip address 45.219.46.130.in-addr.arpa 2019-11-20T11:15:58.435-0500 1 ip address ip address 45.219.46.130.in-addr.arpa 2019-11-20T11:16:58.436-0500 1 ip address ip address 52.227.46.130.in-addr.arpa 2019-11-20T11:14:49.375-0500 1 ip address ip address 4.0.22.224.in-addr.arpa 2019-11-20T11:08:21.380-0500 2 I'm seeing multiple duplicates of the same query, but with only a few seconds, or minute difference in some cases. I am trying to prevent those duplicate query types from showing in the report and only show the total number of hits for each unique query. Hope this is clearer. Thanks ... View more