Hi Santosh, Were you able to solve this problem. Regards Murali ... View more

I think the logic should be tweaked at the end to negate it at the end from the lookup file or It could be done at the beginning also. Am posting to negate it at the end eventtype=wineventlog_system signature_id=7036 | rex field=Message "The (?[\w\s-]) service entered the (?\w) state" | where action="running" | inputlookup append=t previously_seen_running_windows_services | multireport [| stats earliest(eval(coalesce(_time, firstTime))) as firstTime, latest(eval(coalesce(_time, lastTime))) as lastTime by serviceName | outputlookup previously_seen_running_windows_services | where fact=fiction ] [| eventstats earliest(eval(coalesce(_time, firstTime))) as firstTime, latest(eval(coalesce(_time, lastTime))) as lastTime by serviceName | where firstTime >= relative_time(now(), "-60m@m") AND isnotnull(_time) | stats values(dest) as dest by _time, serviceName] | table _time, serviceName, dest | search NOT [| inputlookup previously_seen_running_windows_services | fields _time, serviceName, dest] ... View more

Thanks it worked for me! ... View more

Try this | tstats summariesonly=true allow_old_summaries=true dc(Malware_Attacks.date) as "day_count",count from datamodel=Malware.Malware_Attacks where nodename=* by nodename "Malware_Attacks.dest","Malware_Attacks.signature" | search nodename!=Malware_Attacks.Allowed_Malware ... View more

To reload your endpoints type the following into your browser: http://:8000/en-US/debug/refresh In addition, index-time props and transforms do not require restarts, as long as your indexers are receiving the data from forwarders. That is to say: Changes to props.conf and transforms.conf on an indexer do not require restarts. In an indexer cluster, changes to props.conf and transforms.conf are automatically reloaded when the peers receive the changes from the master. On a non-clustered indexer, changes to props.conf and transforms.conf require a reload. On either a clustered or non-clustered indexer, once the .conf files have reloaded, the changes take effect after a forwarder auto-LB time period. Refer this page https://docs.splunk.com/Documentation/Splunk/7.2.0/Admin/Configurationfilechangesthatrequirerestart ... View more