Thanks very much for the solution @yuanliu Much appreciated! ... View more

Frustration is the least emotional state I wanted to achieve here. Apologies! I still believe it was not me confusing people, I just wanted help with simply being able to compare two datasets and printing out the only hosts seen in one of the data sources. if that sounds confusing then again apologies. I have been a member for some time now and always admired all the help given here. I have tested all solutions provided so far, and seen no results (it might be my fault). The only solution that provided me with the results I want was the following for all to use. I agree (do not have great knowledge around set command as of now) set might not be as efficient as other commands bet here is what worked for me. | set diff [| tstats count where source_1 by host | table host] [| tstats count where source_2 by host | table host] That SPL provides a list of all of the hosts not seen in source_2 At the end of the day it is important for people to get some working examples. They are testing and either working or not working. Silence is gold time to time and no one wants frustration waves. I was not meant to do any harm. Been in the industry for a long time enough to realize we all different and have different emotions. Please, by all means if you can create something that would prove me wrong or anything better than set command for the community to use. Thank you! ... View more

Thanks for the reply @yuanliu  Agree to disagree. If you look at the very beginning of my post I asked: "I have a challenge finding and isolating the unique hosts out of two sources" I think this is clear and SysMon and DHCP were just an example. Nothing concrete. During the communication I have reiterated this statement. Apologies if misunderstood. Thanks all for your help. ... View more

Thanks for your reply @yuanliu  Unfortunately, your search did not provide the results I wanted. After executing the separate searches and abstract manually the result differs from the resultant of your search. Please do try it out. After lots of try/error I finally found the one that does the trick. It is by using 'set diff' command. I will provide my solution tomorrow for everyone to use. Regards, Dan ... View more

Hi, thanks for the reply. To simplify it let us say we have two lists of items of same type it could be anything. How can we compare both lists and list only the subset of items not common to both lists. Regards, D ... View more

Thanks for the reply @PickleRick  Sure, there will be a third column containing only assets that are not seen in both sources simultaneously and  in addition at the end of the list there should be Totals of these assets. Would you be able to develop a sample solution for this, please? Thank you. ... View more

@PickleRick Thanks for the reply. Please, ignore both searches. What I want to pull out the total unique assets in the DHCP source. I then want to be able to compare to the totals of unique assets in the SysMon source and output these assets that do not have SysMon present. Thanks in advance. ... View more

Hi, thanks for the reply @richgalloway  All you said make sense.  However, there are few scenarios where this statements might be out of order. Let me justify what I think. Splunk SE accessible from outside? Do not think any on prem instance is designed to be remote accessable. Anything can be reached vIa a switch (IP + port). All can of course be configured to restrict Internet to Intranet communication. Not even considering insiders and how all even read only users handle queries they send to the SE switch URI etc. I am sure the following will change our perspective of what this may cause if ignored as low severity: https://blog.hrncirik.net/cve-2023-46214-analysis Attackers, attack as service plus AI capabilities makes it even harder for defenders to defend. We simply do not know what we do not know in most instances before they get announced as Zero days. Thanks ... View more

Thank you. I tried it and it looks like there are lots of duplicates and for example SysMon fields were as same as to XmlWinEvtLogs and there was no difference between fields within Application and Security for example. Would you be able to have a look into the SPL and see if it can be optimized, please? Kind regards, Dan ... View more

Thanks for the reply @ITWhisperer  Would it be possible to help me out creating something similar which can include both source and sourcetype, please? Thank you! ... View more

Hi @gcusello thanks for your reply. Agree with what you suggested. However, I found it challenging to recognize stanzas that can be used for completing each individual field. I am using Vladiator and filling in gaps that way.  From what you said "Following your example: WinRegMon  belongs to the Splunk_TA_Windows Add-On that's CIM 4.x Compliant, so you don't need to perform any action."  WinRegMon was there but I had to discover it myself as all options that come under the default folder/inputs.conf are lots and they are disabled by default for the user to decide on which ones to enable and for what purpose. Would you be able to help me identify the best and appropriate way to decide on how to enable the Ports Data Set's fields (currently not getting any data in...is ti coming from SysMon or any other data sourcetype?) from the Endpoint Data Model? Hope you can understand my challenge. ... View more

@isoutamothanks for the tip. Unfortunately, I have no datamodels I can use ATM Regards, ... View more