Good morning In a kv store we have 3 columns: Subcontrol, Value1 and Value2. We are trying to calculate the percentage of Value1 and Value2 for each of the rows with a | eval and that creates new fields with the percentage, for example:     Expected result: Subcontrol1%=0 Subcontrol2%=0 Subcontrol3%=100   Does anyone know how to perform the query to get the percentages in a new field for each row? Greetings and thank you very much in advance. ... View more

Good morning, We are trying to use a kvstore to store data when performing a query to later query it in a dashboard. The kvstore has the following data: Subcontrols | Value1 | Value2 1.1                    | 100       | 99 1.2                    | 200       | 80 1.3                    |99           | 98 Reviewing the documentation and following the examples we can enter a number manually in the query and change the value using a | eval : | inputlookup ciskvstore | eval key=_key | where SubControls="1.1" | eval Value2=526 | outputlookup ciskvstore append=True And the result would be the following: Subcontrols | Value1 | Value2 1.1                    | 100       | 526 1.2                    | 200       | 80 1.3                    |99           | 98   The problem appears when we try to update the Value2 field of a Subcontrol from another query: EX: | inputlookup ciskvstore append=true | where SubControls="1.1" | append [| search index=paloalto sourcetype="pan:threat" | stats count as Value2 ] | outputlookup ciskvstore append=true The result in the kvstore would be the following: Subcontrols | Value1 | Value2 1.1                    | 100       | 526 1.2                    | 200       | 80 1.3                    |99           | 98                                             | 396 Could someone help me and tell me how to correctly perform the query so that from another query I can write the Value2 field of a specific Subcontrol please?   Thank you very much in advance, ... View more

Hello, we are trying to parse logs from a dlink DXS-3600 but we are not able to find the correct format, we have tried with several versions of syslog but it does not work. Does anyone know what format these logs are in? Oct 15 15:36:04 10.68.16.16 Oct 15 13:36:04 10.68.16.16 INFO: Successful login through Web (Username: Gestion, IP: 10.168.0.53) Oct 15 15:41:45 10.68.16.16 Oct 15 13:41:44 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: running-config.cfg) Oct 15 15:42:13 10.68.16.16 Oct 15 13:42:14 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: running-config.cfg) Oct 15 15:42:33 10.68.16.16 Oct 15 13:42:34 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: startup-config.cfg) Oct 15 15:42:44 10.68.16.16 Oct 15 13:42:44 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: startup-config.cfg)   Greetings ... View more