I have a report that lists malware received by email that is part of a dashboard. Some months the list for each person can have dozens of events listed. Management would like to only show the latest 5 events for each person. I'm having difficulty finding a good way to accomplish this. Search: index="my_index" [| inputlookup InfoSec-avLookup.csv | rename emailaddress AS msg.parsedAddresses.to{}] final_module="av" final_action="discard" | rename msg.parsedAddresses.to{} AS To, envelope.from AS From, msg.header.subject AS Subject, filter.modules.av.virusNames{} AS Virus_Type | eval Time=strftime(_time,"%H:%M:%S %m/%d/%y") | stats count, list(From) as From, list(Subject) as Subject, list(Time) as Time, list(Virus_Type) as Virus_Type by To | search [| inputlookup InfoSec-avLookup.csv | rename emailaddress AS To] | sort -count | table Time,To,From,Subject,Virus_Type | head 5 Current Output: time - user1 - sender1@xyz.com - Subject1 - Virus_A time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_C time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_B time - user2 - sender1@xyz.com - Subject1 - Virus_A time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_C time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_B time - user3 - sender1@xyz.com - Subject1 - Virus_A time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_C time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_B I'd like to limit it to the latest 5 events by user time - user1 - sender1@xyz.com - Subject1 - Virus_A time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_C time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_B time - user2 - sender1@xyz.com - Subject1 - Virus_A time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_C time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_B time - user3 - sender1@xyz.com - Subject1 - Virus_A time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_C time -              - sender2@xyz.com - Subject1 - Virus_B time -              - sender2@xyz.com - Subject1 - Virus_B Any help greatly appreciated! Thank you!   ... View more

Hello, I'm building a report to list all phishing and malware threat detections by sender, classification, and threat url. The data contains two types of events "clicksAllowed" and "clicksBlocked". I want to add a list of recipients if their click was allowed "clicksAllowed" and I'm struggling with how to structure my query. I'm currently trying to do this with stats and eval (I thought about using subsearch too maybe), hopefully, I'm on the right track but I can't figure out how to show only the recipients who clicked while still showing counts of how many clicks were allowed and blocked. Current search (without who clicked): index=tap sourcetype="pp_tap_siem" classification IN (phish, malware) threatStatus=active | eval time=strftime(_time,"%m/%d/%y @ %H:%M:%S") | stats earliest(time) AS First_Seen, latest(time) AS Last_Seen count(eval(eventType="clicksPermitted")) AS Clicks_Permitted, count(eval(eventType="clicksBlocked")) AS Clicks_Blocked, values(threatURL) AS TAP_Link BY sender, classification, url | table First_Seen, Last_Seen, classification, sender, Clicks_Permitted, Clicks_Blocked, AT_Risk_Users, url, TAP_Link | sort -Last_Seen Output looks like: First_Seen Last_Seen classification sender Clicks_Permitted Clicks_Blocked  AT_Risk_Users url TAP_Link 03/14/23 @ 17:52:36 03/14/23 @ 17:52:36 phish badguy@domain.com 1 1 list of 1 person here hxxp://baddomain.com hxxp://link_tothreatintel_webportal.com/uniqueguid 01/05/23 @ 12:34:44 01/05/23 @ 17:44:41 phish badguy2@domain.com 39 3 list of 39 people here hxxp://baddomain2.com hxxp://link_tothreatintel_webportal.com/uniqueguid 01/18/23 @ 15:43:20 02/16/23 @ 22:46:19 malware badguy3@domain.com 4 0 list of 4 people here hxxp://baddomain.com hxxp://link_tothreatintel_webportal.com/uniqueguid ... View more