I see in previous .conf presentations screenshots that show a Topology dashboard within the Microsoft Azure App for Splunk. Specifically .conf20's SEC1059C and .conf19's IT1433 presentations. When I download the most recent version 1.1.0 I do not see that listed. Has the dashboard been removed/deprecated? If so is there a way I can get the .xml so that I can attempt to re-create?   @jconger  ... View more

In an Enterprise Security Correlation Search I have a report that emails out when an email address is seen across multiple unique accounts. Each unique account has its own row and I have a field called dc_accounts that shows a count of how many unique accounts the email address is present on. I'm trying to determine the best way to throttle within the correlation search. The search time window spans 90 days and I only want the rows to show up on the report again if the count increases (so accounts are not re-reviewed). I think the best way to throttle is to throttle the fields account, email and dc_accounts. But I only want to throttle if dc_accounts increases from the previous value. So if the account and email values are the same and dc_accounts is less than or equal to the previous value I don't want to see it. Is there a way to achieve this? I have thought about writing my output of each run to a lookup file and then have an inputlookup earlier in the search that retrieves the previous value and compares. But I am not sure if that is the only option available. Portion of search that is relevant is below. There are multiple roles per account which is the reason for the multi-value names and user-id fields. | dedup first_name, last_name, acct_no, user_id, email | stats list(first_name) AS first_name list(last_name) AS last_name list(user_id) AS user_id values(acct_no) AS acct_nos by email | stats list(first_name) AS first_name list(last_name) AS last_name list(user_id) AS user_id dc(acct_nos) AS dc_accounts by email,acct_nos | search dc_accounts>1 | mvexpand first_name | mvexpand last_name | mvexpand user_id | dedup email, acct_nos, first_name, last_name, user_id | stats values(email) AS email values(first_name) AS first_name values(last_name) AS last_name values(user_id) AS user_id by acct_nos, dc_accounts | eval first_name=mvjoin(first_name, " ; ") | eval last_name=mvjoin(last_name, " ; ") | eval user_id=mvjoin(user_id, " ; ") | table first_name, last_name, acct_nos, user_id, email, dc_accounts | sort 0 -dc_accounts,email ... View more