I have an Event where I can extract the 2 different ID's but how do I show that id 1 gave access to id 2? Sample event  User-ABCDEFG assigned Role-'NewRole' on Project-1234 to ABCDEFG I need to say the User-ABCDEFG gave access to ABCDEFG in a stats sort of way - the user may give 4 or 5 accesses a day so I would then create a report which shows that that user did. ... View more

I have a simple search  index=xxxxx "User ID" and I need the correct syntax to get the actual username in the results. Sample Event INFO xcvxcvxcvxcvxcvxcvxcvxcvxcvxcvvcx - Logged User ID-XXXXXX Now I can easy do a count of how many people logged on but need to report on the XXXXXX I thought about doing index=xxxxx 'User ID" | rex field=_raw "User\/s\ID\/-\(?<username>\d+)" | stats count by username The search is returning the results and just a count but I need to see the username in my stats. I am new to this so please mind the ignorance  ... View more

So I have a query which returns a value over a period of 7 days   The below is like the query but took a few items out   index=xxxx search xxxxx | rex field=_raw "projects/\\s*(?<ProjectID>\d+)" | rex field=_raw "HTTP\/1\.1\ (?P<Status_Code>[^\ ]*)\s*(?P<Size>\d+)\s*(?P<Speed>\d+)" | eval MB=Size/1024/1024 | eval SecTM=Speed/1000 | eval Examplefield=case(SecTM<=1.00, "90%")| stats count by Examplefield | table count I can get the single value over 7 days I want to be able to do like a comparaison over the previous 7 days So lets number is 100,000 and prevous week was 90,000 then it shows up 10,000 or vice versa if that makes sense. I have seen the Sample Dashboard with Single Value with an arrow going up or down but I just have no clue how to syntax the time bit ... View more