Hi @richgalloway, I have been trying to do what you say whole week-end. I came with this but nothing seems to work, I'm not getting it to work.  | ldapsearch domain="default" search="(&(objectClass=group)(cn=GROUP_NAME))" | ldapgroup | append [ ldapsearch domain="default" search="(&(objectClass=user))" attrs="sAMAccountName" | rename sAMAccountName AS user | fields user] | stats values(member_name) as member_name values(user) as user by Joinkey | eval result=if(match(member_name, user),"Contained","Not Contained") Can you give me an example of how I should do it?  Thanks, Sasquatchatmars   ... View more

Hi @richgalloway, I have been trying your suggestion but I can't quite seem to make it work. Would it be possible for you to correct the searches I have made so that I will have an example for futur references?  For the first one I tried to by renaming the member_name field to user in order to have a common field named user. Than by adding | stats values(*) as * by user which would give    | ldapsearch domain="default" search="(&(objectClass=group)(cn=GroupName))" | ldapgroup | append [ ldapsearch domain="default" search="(&(objectClass=user))" attrs="sAMAccountName" | rename sAMAccountName AS user | regex user!="^([a-zA-Z0-9_\.-]+)\$$" | search user!="$*" | fields user] | stats values(*) as * by user | eval result=if((member_name=user),"Contained","Not Contained")   By the way I started using an ldapsearch as base search so that I'm sure I will always get the updated values.  For the second search I ran the | format command in the subsearch and uderstand want you mean. The problem is that I don't know how to modify the subsearch so that it will output normal results. Now it shows this.   ( ( user="USER1" ) OR ( user="USER2" ) OR ( user="USER3" )OR ..... )   I also tried to add the NOT before the subsearch but is it possible that this can't be used with an ldapsearch? Because I tried this and it gave me an error "Script execution failed for external search command 'ldapgroup'   | ldapsearch domain="default" search="(&(objectClass=group)(cn=EV_*))" | ldapgroup NOT [| inputlookup account_status_tracker | fields user] | rex field=member_name "(?<username>\S+)+" | eval result=if(match(member_name, user),"Contained","Not Contained")   I am not working with splunk since a very long time so I'm still trying to learn, sorry if I may be asking basic questions.  Thank you, Sasquatchatmars    ... View more

Hi @gcusello, Thanks yes indeed, you said that 😊 Oh sorry I forgot, I'll accept it right away. Thank you, Sasquatchatmars ... View more

Hi @gcusello, This did work tahnk you but I found I found an easier way. I just added a TimeStamp column to my csv file so the file changes every time.  Thank you anyway!  Sasquatchatmars ... View more

Hi @gcusello, It doesn't indexes it at all.  I tried the modular input. Somehow at some points the scripts sees some kind of errors because it is based on a list of servers. These servers are not always working so it generates an error. At that moment the idexing stops and doesn't continue.  By the way I tried indexing it file by file which works. But what i really want is to monitor all the csv files in the directory without everytime needing to specify the file path in the data inputs. Thanks, Bob van Scheijndel ... View more

Hi @richgalloway , This worked like a charm, thank you very much!  Sasquatchatmars ... View more

Hi @richgalloway, Thank you this worked! Sasquatchatmars  ... View more

Hi @SkuLLo99, That is because you only changed the name of the dashboard and not the ID. You will have to make a new Dashboard with another Dashboard ID  than alerts then delete the old Dashboard. Sasquatchatmars ... View more

Thank you very much for your help, this is what i needed! ... View more

I made indeed an error because in the log part it isn't supposed to be "username" but "recipient" I will made the change. Maybe there is no hit but in that case I don't know what I should use as search to verify if the field "recipient" is in the url. Do you maybe know it? ... View more

Yes it is the same, splunk has made two field one with receiver_email and the other is recipient but they are the same. If I replace my command with yours it doesn't work either. ... View more

This is my search query.   index=[index_name] | rename content_body{} AS content_body, receiver_email{} AS receiver_email | where match(content_body,"\"https://.*".recipient.".*\" ") | dedup sender_email | table recipient sender_email content_body username   FIY recipient is firstname.lastname@domainname And the part of the log is   "https://f22c834a4f224bcbb563c127f7a8477f.svc.dynamics.com/t/r/zyqi3= CfkIaT_ZSLfiMGTiZjG5y-6Cc5jKCmGO0YH-Nc#[recipient]:e8990=3D23" /!\ Be aware, this link is a phishing link /!\     ... View more

Hi @ITWhisperer, Thank you for your reply. Yes it is exactly the same, that is why I don't understand why it doesn't work Sasquatchatmars   ... View more

Hi @richgalloway, This was what I needed thank you! Sasquatchatmars ... View more

Hi @rnowitzki, Thank you this was the answer! Sasquatchatmars ... View more

Hi @rnowitzki , Is there a way to use all results from the search, the $result.name$ only uses the first result of the field. My search has multiple results. I tried the token $results.name$ but did didn't seemed to work.  Thank you, Sasquatchatmars ... View more

Hi @rnowitzki  Thank you very much for your help, this was exactly what I needed! Sasquatchatmars ... View more