Hi, I have Windows Event for specific application that have payload in Windows Event Log, when using Splunk_TA_windows to extract data will get field with multipe "Data". <Data>process_name</Data><Data>signature_name</Data><Data>binary_description</Data> How can I extract it automatically to fields/value: process_name = process_name signature = signature_name binary = binary_description   Is there any way without using "big" regex? to just $1:$2:$3.. and then add names to $1, $2, $3 like for CSV. something like:  REGEX = (?ms)<Data>(.*?)<\/Data> this will create maybe one multi value field and then assign Field_name ... View more

Hi, If I have process Events like PID | ProcessName |  CommandLine | SpawnedByPID 100 | process_1 | process_1_commandLine | 99 101 | process_2 | process_2_commandLine | 100 200 | process_3 |  process_3_commandLine | 199 201 |  process_4 |  process_4_commandLine | 200 Is there any Viz that will map processes in some Folder/EDR like tree (where I can also click on node and get mora info). For example, final results are based on PID but Viz looks like something like | -> process_name_99 |----> process_1 (on hower or Click will get token process_1_commandLine) |--------> process_2 | -> process_name_99 |----> process_3 |-------->process_4 Something like psTree just more advanced and connected by PID not names. ... View more

hi, I have two KV_Store lookups as they are huge: * one is more than 250k rows * second and 65k rows.  In "250k" row lookup is only IP while in second one are IP CIDR+LIST So,  I do search like     | inputlookup list_250k | rename ip_cidr as ip | eval convert_ip=tostring(ip) | lookup list_65k ip_cidr AS convert_ip OUTPUT ip_cidr, list | where isNotNull(ip_cidr) | rename ip_cidr as found_in      I am getting results. I am curious are there any limits? if for example search is limited, would I see some error  (as there is no progress bar that it's working something)? ... View more

Hi, New Dashboard's does not have Timeline vis. what do you use for representing data in Time series and find where there are overlapping? Basically what I have is this: Engine name Scan name Start time End time test 12_14 12:00 15:12 test 14:30_17:00 14:30 16:45 test_another_engine 13_14 13:00 13:52 ...         Now I would like to put in inside some visualization during 24h where I can see "start time", "duration" and if there is overlapping in duration between two "Scan names".  In example above we can see that 12_14 last's longer that expected and then overlapped with 14:30_17:00 (now I would like to see that overlapping and on click [token] populate another Vis for that "Engine"). I would like to create all in new Dashboards but there is no Timeline visulization. Timeline vis is also great but not in new dashboards or I can hover and see what "Scan name" is. Timeline vis is almost what I need as it shows duration through 24h, group by "Engine name" but is lacking "Scan name", old Dashboard, ... What would you recommend for Vis as workaround? ... View more

Hi,  When creating Dashboard in the new Dashboard studio, I have a lot of Inputs for Filter.   I would like to break Inputs (or group them) in new Line so that Inputs are more easily reviewed.   Example: line 1 – inputs for Asset (like Hostname, IP Address, …), line 2 – inputs for example vulnerabilities (cve, base_score, …)  I don’t see any option to move input into new line, this is now very uncomfortable as it is just lots of inputs without clear visibility (and depends on screen size where input will be, first row or second row).   I saw lots of solutions for Classic dashboard, but what about new Dashboard?  Thank you. ... View more