Alright, if it isn't possible, I'll use your query. Thank you! ... View more

After seeing you guys suggestions, I was able to come up with the subsequent query; giving me the expected results. Thanks for shedding some light on me. index=test_csv (source="Detected*.csv" OR source="Stopped*.csv") sourcetype="csv" | eval cat = if(cat=="new", "web", cat) | eval action = if( like( notif , "%Deny%" ) OR like( notif , "%Terminat%" ) OR like( notif , "%Block%" ), "Blocked" , "Detected" ) | stats count(action) as detected , count(eval(action=="Blocked")) as blocked by rep , cat | sort -detected , -blocked | stats values(rep) as "Rep" , list(detected) as Detected , list(blocked) as Blocked by cat | sort -Detected | rename cat as categories ... View more

Thanks for the reply. My query sorts by the total of threats for each device, which is on the x axis of the chart, but I would like to also sort by the total amount of each individual threat on those devices on the y axis. ... View more

Doing what you suggested made the statistics show incorrect values for Detected and Blocked. ... View more

Thanks for the reply, Justin. Yes, this is what I also thought, but wanted to confirm on behalf of someone. ... View more

The query is correct but, there isn't any data present that matches the values from the lookup file. Thanks for the help! ... View more

I tried the following search: your base search to get indexed data [| inputlookup yourLookupDefinition | table YourLookupFieldName | rename YourLookupFieldName as yourIndexedDataFieldName] where yourIndexedDataFieldName is an extracted field. Taking in consideration that field names are case sensitive, I rechecked the query and everything looks fine. ... View more

Thanks for the reply, somesoni2. My case is the second example, which I executed but, it isn't returning anything. If I execute the following query separately it does return results: | inputlookup yourLookupDefinition | table YourLookupFieldName | rename YourLookupFieldName as yourIndexedDataFieldName Thanks! ... View more

Sorry for the late response, alemarzu. The regex worked. Thanks for all your help! ... View more

Here's the sample of the string to match. {"quarantined" : false,"targetPriorityType" : "MEDIUM","deviceOwnerId" : 72622,"deviceGuid" : null,"email" : "test@test.net", "deviceSessionId" : null,"assignedToId" : null,"assignedToName" : null,"deviceType" : "WINDOWS","activationCode" : "CODE","firstName" : null, "lastName" : null,"middleName" : null,"createTime" : null,"lastReportedTime" : 1502916617373,"deviceId" : 235183,"organizationId" : 000, "lastVirusActivityTime" : 0,"firstVirusActivityTime" : 0,"osVersion" : "Windows 10 x64","activationCodeExpiryTime" : 1496944516188, "organizationName" : "COMPANY","sensorVersion" : "X.X.X.X","registeredTime" : 1496339794497,"lastContact" : 1502917965783, "windowsPlatform" : null,"vdiBaseDevice" : null,"avStatus" : [ "AV_ACTIVE","ONDEMAND_SCAN_DISABLED" ],"deregisteredTime" : null, "sensorStates" : [ "ACTIVE","SECURITY_CENTER_OPTLN_DISABLED" ],"messages" : null,"rootedBySensor" : false,"rootedBySensorTime" : null, "lastInternalIpAddress" : "192.168.X.X","lastExternalIpAddress" : "X.X.X.X","lastLocation" : "OFFSITE","sensorOutOfDate" : false, "avUpdateServers" : null,"passiveMode" : false,"lastResetTime" : 0,"lastShutdownTime" : 1497873764155,"scanStatus" : null, "scanLastActionTime" : 0,"scanLastCompleteTime" : 0,"linuxKernelVersion" : null, "avEngine" : "X.X.X.X-ave.X.X.X.X:avpack.X.X.X.X:vdf.X.X.X.X","avProductVersion" : "X.X.X.X","avAveVersion" : "X.X.X.X", "avPackVersion" : "X.X.X.X","avVdfVersion" : "X.X.X.X","avLastScanTime" : 0,"rootedByAnalytics" : false,"rootedByAnalyticsTime" : null, "testId" : -1,"avMaster" : false,"uninstalledTime" : null,"encodedActivationCode" : null,"name" : "TEST-PC","status" : "REGISTERED", "policyName" : "TEST","policyId" : 8287} ... View more

Hi alemarzu, Thanks that helps, but in my case, it would be from a single host (hostA), but I get the idea. I guess my issue is the regex to match the testA; it seems that putting testA, as it is, in REGEX doesn't do the trick. Thanks! ... View more

(...) | rex mode=sed field=amount "s/[^\d\.-]//g" | bucket _time span=1d | stats count as myCount sum(amount) as myAmount by _time id name | rename id as IDs | eval NameCount = name." ----- ".myCount | eval TotalCount = name." ----- $".myAmount | stats values(NameCount) as NameCount, sum(myCount) as Count, values(TotalCount) as TotalCount , sum(myAmount) as Total by _time IDs | eval Total = "$".ROUND(Total,2) | rename Total as "Total Amount" TotalCount as "Amount by Name" | rename NameCount as "Names ----- Count by Name" ... View more

Thanks for the help. How can I split the total amount by counted names? ... View more

Thanks. I forgot to put Names as the following: | stats values(name) as Names (...) because I would like to have the sum of each unique value of it in: list(count). ... View more

Thanks for the reply, someoni2. Here's my current query: (...) | rex mode=sed field=amount "s/[^\d\.-]//g" | bucket _time span=1d | stats count by _time id name amount | rename id as IDs | stats values(_time) as Dates values(name) as Names list(count) as "Count by Name" sum(amount) AS total by IDs | eval Total = "$".total | rename Total as "Total Amount" | fields - total | sort - Dates | convert timeformat="%m/%d/%Y" ctime(Dates) ... View more

Hi rjthibod, Thanks for the reply. The table is for showing how would I like output of the resulting query. No. Bar, in this case, is another numeric field that I would like to use for displaying the events. "Event" was changed to num, meaning the count of Foo itself, Foo under Bar > 5, and Bar < 5 conditions subsequently. ... View more

Thanks, cusello! ... View more