when I run your search I got too many results , with rare I got only 10 results. there is no options to use rare and add more fields to the table? ... View more

but I want to get the most unique SHA256HashData in the last 24h for example. and then fwd to summary index and start static about it, so for that I need to get more data ... View more

sure. attached the valueCount and Pct. also the number of events:  1,380,350 events ... View more

its looking very good! thank you. I just dont understand the calculate results.  for example: in valueCount I have 294723 from the total which is 1360007 should be ≈ 21.67% but in Pct field value I have 0.33, Do you know why? all my results in Pct are not correct.  ... View more

I would like to get the percentage of some count field from the total count for example:  after using fieldsummary I got this: [{"value":"/System/Library/LaunchAgents/com.apple.mdworker.shared.plist","count":61372} under value key and the total count events is1,039,803, so in a new field I want to get the calculate for how much in percentage the count (61372) is from the total (1,039,803), this result I want to get to all my fields.  ... View more

Ok, now i see and get the data.    thanks! ... View more

now I see  first I missed double quote, so you are correct - so my search is:  | mstats avg("value1") prestats=true WHERE "index"="my_index" span=10s BY host | timechart avg("value1") span=10s useother=false BY host WHERE max in top5   now, if I want to search by what you worth: | mstats avg("value1") prestats=true WHERE "index"="my_index" span=10s BY host | untable _time host average | stats dc(host) as c_host    OR | timechart avg("value1") span=10s useother=false BY host WHERE max in top5 | untable _time host average | stats dc(host) as c_host     Anyway, I want to use mstats function and get a count for the host.  ... View more

not sure why you say that. but its working. just to be clear = value1 = to some internal parameter. index = my index. and base on that Im getting information about  the hosts .  now I just want to count how many hosts reporting, when its less then 3 I want to trigger about it.  hope its clear now.  ... View more

this is my search:  | mstats avg("value1) prestats=true WHERE "index"="my_index" span=10s BY host | timechart avg("value1") span=10s useother=false BY host WHERE max in top5 which is working fine.  I just want to create a new alert that triggered when the host count is less then 3.  how can I do that? ... View more

thank you, its working! ... View more

this one?  this is working for me in SPL and I add automatic lookup - which not working ( didnt extract the fields)  ... View more

The purpose is to enrichment the data automatically  I did it in the UI under automatic lookup: my lookup id AS id OUTPUT my fields_from_the_lookups it always working but the diff here is that I'm using KVstore    thanks   ... View more

thanks!  ... View more

BTW, I have created 2 fields base on my lookup - when the ip is exist I have new fields : my_ip = True  this is can be easer to compare now? without using lookup  ... View more

the result returns me nothing 😞 I'v changed the exist to the filed from my lookup and the value as well and nothing come up. what I missed? ... View more

yes, I thought about it, and what about the rest? ... View more

what I tried to do is to compare the data from CIDR to lookup with IP I have a list of internal  IPs and in the audit I have only CIDR,  how can I compare it?    thanks! ... View more

this is exactly my case. I have lookup contains my ip and on the events I have only the range. there is any solution to compare it?  ... View more