Hello, I have a table with the following fields from an email security system that are duplicated within a time range of 3s: _time    sender    receiver    subject    attach 2023-08-07 14:07:46 sender1@domain.com receiver1@domain.com receiver2@domain.com "email subject" attach1.pdf attach2.pdf 2023-08-07 14:07:49 sender1@domain.com receiver1@domain.com receiver2@domain.com     2023-08-07 15:10:05 sender2@domain.com receiver3@domain.com receiver4@domain.com     2023-08-07 15:10:08 sender2@domain.com receiver3@domain.com receiver4@domain.com "email2 subject" attach3.rar attach4.rar 2023-08-07 16:11:08 sender3@domain.com receiver5@domain.com     I want to merge the duplicated fields together within the range of 3s without losing the subject and attach value, but I don't want to remove other blank values of the emails that are sent without a subject or attach. It should look like this:   _time    sender    receiver    subject    attach 2023-08-07 14:07:46 sender1@domain.com receiver1@domain.com receiver2@domain.com "email subject" attach1.pdf attach2.pdf 2023-08-07 15:10:08 sender2@domain.com receiver3@domain.com receiver4@domain.com "email2 subject" attach3.rar attach4.rar 2023-08-07 16:11:08 sender3@domain.com receiver5@domain.com     Thank you. ... View more

Hello everyone, I need to extract the first IP from ASA events, after the first IP sometimes there are 3 other IPs, sometimes 2, and sometimes 1 IP, but I need only the first one without depending on how many IPs are after the first. 2023-07-13T11:24:25+02:00 FirASA : %ASA-6-302013: Built inbound TCP connection 2907550162 for dmzIB:192.168.7.7/49446 (192.168.7.7/49446) to inside:10.100.40.4/8080 (10.100.40.4/8080) Thank you. ... View more

Hello everyone, I have the following results when running my search: _time                                        user             connection 1 2023-01-09 20:36:04   john        Transport closing 2 2023-01-09 20:32:45   brian      DPD failure 3 2023-01-09 19:44:26   tom         assigned to session Please, I want to configure an alert to send the _raw field by email to the specific user (by adding @gmail.com), every time it returns results from that user, (ex. john@gmail.com, brian@gmail.com, tom@gmail.com) Thank you in advance. ... View more

Hello, I have created and imported a lookup file ex. "hashes.csv" and I have pasted there a list of 500+ hashes. I want to search with index=* to see if I find any of these hashes in _raw field of any type of log. Thank you in advance. ... View more

Hello everyone, Please, I need to extract a field named product (with its value in bold) from the below Message field values, and a field named status (with its value in italics): Message="Product: Microsoft SQL Server 2019 LocalDB -- Installation completed successfully." Message="Product: Microsoft OLE DB Driver for SQL Server -- Installation completed successfully." Thank you in advance. ... View more

Hello, I want to extract 4 fields using regex with their respective names in bold and their respective values as per below: Hashes="SHA1=27EFA81247501EBA6603842F476C899B5DAAB8C7,MD5=49E93FA14D4E09AAFD418AB616AD1BB1,SHA256=35E3F44C587DE8BFF62095E768C77E12E2C522FB7EFD038FFFCC0DD2AE960A57,IMPHASH=B7A4477FA36E2E5287EE76AC4AFCB05B" The actual field name is "Hashes", I want to extract one field named SHA1 with the value "27EFA81247501EBA6603842F476C899B5DAAB8C7", one field named MD5 with the value "49E93FA14D4E09AAFD418AB616AD1BB1" etc. Thank you in advance. ... View more

Hello everyone, I have built a search that returns the email sender address as sender, its recipients list as recipient, and the number of emails received. One event looks like this: sender                                                                        recipient                 nr of emails sent user.sender@outsidecompany.com user1@company.com 16                                                                           user2@company.com                                                                          user3@company.com                                                                          user4@company.com                                                                          user5@company.com                                                                          user6@company.com                                                                          user7@company.com I want to define the recipient field values to be 10 recipients or more because let's say I'm not interested to see outside emails from a sender that has sent an email to less than 10 people inside company.com. Do you have any idea? Best regards. ... View more

Hello everyone, I have a field named SQL_NAME with values as per below (I'm writing two of them): #1(8):EMEMEB #2(14):8/3/2022 0:0:0 #3(13):Ememe Behe #4(3):409 #5(0): #1(6):TSUDE #2(14):8/1/2022 0:0:0 #3(10):Tugu Sude #4(3):411 #5(0): and I want to extract two fields named user and name with their values in the bold strings above using regular expression. Any idea? Thank you in advance. ... View more

Hello everyone, I'm trying to schedule an alert looking like this: index=network host=device1 | stats count by sourceip | where count > 2 (last 7 days). I will schedule it daily and I want it to search the last 7 days to see if an  IP is found more than 2 times and return events like the below:             sourceip         count 1   162.14.xxx.xxx       5 2   185.225.xxx.xxx    7 3   203.122.xxx.xxx    3 4   61.246.xxx.xxx       6 The problem is that the next day I don't want to see the same results if there is no new data from a new IP from the last 24h. So I need to add a condition that will only allow the search to return results if a new returned result (where count > 2) is added to the results last 24h. Do you have any suggestions? Thank you in advance. ... View more