hi i try with iplocation ClientIP it does not work ... View more

@gcusello wrote: Hi @sulaimancds, are you sure that the fieldname, after the spath command is exactly "ClientIP "? Usually after a spath command, the field names are more complicated. probably you need to rename the field or use that field name in the iplocation command.   index=o365 [ | inputlookup watchlistriskyusers.csv | rename email AS query | fields query ] sourcetype="o365:management:activity" eventtype=o365_authentication | spath | iplocation <your_ClientIP_fieldname> | table UserId ClientIP DisplayName status Country   Ciao. Giuseppe HI it does not work, this is my original command before inserting. IPLocation   index=o365 [ | inputlookup watchlistriskyusers.csv | rename email AS query | fields query ] sourcetype="o365:management:activity" eventtype=o365_authentication | spath | table UserId ClientIP DisplayName   example userid                             ClientIP            displayname abc@gamil.com          1.1.1.1                  abcpc   need help work to show country of the ClientIP ... View more

yes it is able to get the country i try it the the makeresults query ... View more

Error in 'lookup' command: All of the fields in the lookup table are specified as lookups, leaving no destination fields.   so when there are results , the SenderAdress should lookup at the csv again and output another column call event date. ... View more

Sender Address , then the event date from csv will be shown in the results as well ... View more

Hii,   I have answered your queries , can you please help. ... View more

the query is working now to search from csv column address , but event date column should also be shown ... View more

both address and event date address event_date 123@abc.com 2/10/2023   so after the query is run , against address , if there is result , show the date as well. ... View more

index=mail [ | inputlookup email_users.csv | rename address AS query | fields query ] | dedup MessageTraceId | lookup email_domain_whitelist domain AS RecipientDomain output domain as domain_match | where isnull(domain_match) | lookup all_email_provider_domains domain AS RecipientDomain output domain as domain_match2 | where isnotnull(domain_match2) | stats values(RecipientAddress) as Recipient values(Subject) as Subject earliest(_time) AS "Earliest" latest(_time) AS "Latest" values(Status) as Status by RecipientDomain SenderAddress | eval subject_count=mvcount(Subject) | sort - subject_count | convert ctime("Latest") | convert ctime("Earliest") | lookup email_users.csv event date AS date     hi i am trying to get date field in the results , i cannot get it .  results are showing but i need the date from the csv   the event date is from the email_users.csv ... View more

i want to include event date as well, it is from the csv , please help me for that  ... View more

I have a csv call email_user.csv. There are 2 columns, 1 is address another is event date.   i want to show event date in the results as well. event date is from the csv.  event_date 2/10/2023 1/10/2023 30/9/2023 23/9/2023 8/9/2023 ... View more

now the query is working , how to show the column of event date in the results as well , after the query is finish and results has been shown ... View more

i have provided everything , i am sorry if i did not  ... View more

sorry i do not understand your question ... View more

in my csv there are 2 colums , Event date and address address is used for sender address to match the criteria.   so, after the query is run , if there are any results, the Event date from the csv, should be shown with the results in another column   the command which you gave i think it is wrong. ... View more

The search job has failed due to an error.  ... View more

in my csv there are 2 colums , Event date and address address is used for sender address to match the criteria.   so, after the query is run , if there are any results, the date from the csv, should be shown with the results.   the command which you gave i think it is wrong. ... View more

this is the current result.  in my csv, there are 2 columns date and address - which is the sender address, which currently the query is working as shown above. after running the query, if there are any results, the date from the csv also should be shown in of the columns in the result table. RecipientDomain SenderAddress Recipient Subject Earliest Latest Status subject_count gmail.com abc@abc.com.xy abc@gmail.com form 05/16/2023 14:50:11.069507 05/18/2023 23:52:08.009636 Delivered 10 ... View more

@ITWhisperer wrote: If you want more help, you will have to be more specific as to what exactly you have tried. I lost my mind-reading license after a misunderstanding with an African Prince! hi   i tried last week to rename [date AS date | fields date ] in first line  table at the last line i cannot remember ,  ... View more

i use table  and tried to put in stats and on the first line also to show , please help  ... View more

i try but not showing so i need your help with the query, ... View more

the search query is working perfectly , i just need to show the dates from the csv. example if i run the search and the user matches for example 123@gmail.com , the date on the 123.csv for this user is 22/05/2023. It should show the date as well ... View more