TYVM for the reply and info / so basically I'll be ingesting security and request events into the same index with the same sourcetype, but using the source name to distinguish between the two as I can name the HEC data input for WAF requests differently, which will then allow me to filter (and tag) security and requests. ... View more

Thx - that is what I was thinking but figured I'd throw out a prayer ðŸ˜? ... View more

TYVM for the info - greatly appreciated! ... View more

TYVM for the reply and information as it really helped me understand how to use spath much better.  ... View more

TYVM for breaking this down as it's greatly appreciated. I understand what the following two commands do more clearly: | spath path={} | mvexpand {} Can you please expand on the following command? | spath input={} Is that simply saying to look inside the {} brackets for the data? Thx ... View more

Thx for the reply I added the following, but the issue is I'm getting all the MessageCount values back and not just for {}.EventType=GoodMail | stats values("{}.MessageCount")   ... View more

JSON file data is as follows [ { "Organization": "foo.foomail.com", "Date": "2023-01-08", "EventType": "GoodMail", "Direction": "Inbound", "MessageCount": 393253, "Index": 0 }, { "Organization": "foo.foomail.com", "Date": "2023-01-08", "EventType": "GoodMail", "Direction": "Outbound", "MessageCount": 96305, "Index": 2 }, { "Organization": "foo.foomail.com", "Date": "2023-01-08", "EventType": "EmailMalware", "Direction": "Inbound", "MessageCount": 34, "Index": 3 }, { "Organization": "foo.foomail.com", "Date": "2023-01-08", "EventType": "EmailPhish", "Direction": "Inbound", "MessageCount": 9678, "Index": 4 }, { "Organization": "foo.foomail.com", "Date": "2023-01-08", "EventType": "EmailPhish", "Direction": "Outbound", "MessageCount": 111, "Index": 5 }, { "Organization": "foo.foomail.com", "Date": "2023-01-08", "EventType": "SpamDetections", "Direction": "Inbound", "MessageCount": 55265, "Index": 6 }, { "Organization": "foo.foomail.com", "Date": "2023-01-08", "EventType": "SpamDetections", "Direction": "Outbound", "MessageCount": 1155, "Index": 7 }, { "Organization": "foo.foomail.com", "Date": "2023-01-08", "EventType": "EdgeBlockSpam", "Direction": "Inbound", "MessageCount": 614454, "Index": 8 }, { "Organization": "foo.foomail.com", "Date": "2023-01-08", "EventType": "TransportRules", "Direction": "Inbound", "MessageCount": 24843, "Index": 9 }, { "Organization": "foo.foomail.com", "Date": "2023-01-08", "EventType": "EdgeBlockSpam", "Direction": "Outbound", "MessageCount": 722, "Index": 10 }, { "Organization": "foo.foomail.com", "Date": "2023-01-08", "EventType": "TransportRules", "Direction": "Outbound", "MessageCount": 37537, "Index": 11 } ] ... View more

Mucking around some more and getting closer as I now have this: | tstats count AS "Total Traffic" from datamodel=Network_Traffic where (nodename = All_Traffic ) OR (nodename = Blocked_Traffic) All_Traffic.src_zone=INTERNET-O groupby _time span=1d, All_Traffic.src_zone, All_Traffic.action, All_Traffic.Traffic_By_Action.Blocked_Traffic prestats=true | `drop_dm_object_name("All_Traffic")` | timechart span=1d count by action | eval "Block Avg" = round('blocked'*100/('allowed'+'blocked'),2) But two issues: Timechart now shows bars by action and 'd like to see just the total count of network sessions The average is basically flatlined as it's at roughly 40% whereas my totals by action are roughly 1.5B ... View more

@richgalloway  If I wanted to change this search up so it's looking at total traffic events with an overlay of the avg number of blocks, how would I write that query? I have the following but not getting any results: | tstats count AS "Total Traffic" from datamodel=Network_Traffic where (nodename = All_Traffic) All_Traffic.src_zone=INTERNET-O groupby _time span=1d, All_Traffic.src_zone, All_Traffic.Traffic_By_Action.Blocked_Traffic prestats=true | `drop_dm_object_name("All_Traffic")` | timechart span=1d count | stats avg(count) by Traffic_By_Action.Blocked_Traffic Is the issue that I'm pulling from two different objects in the Network datamodel - All_Traffic and Blocked_Traffic and not referencing the Blocked_Traffic model correctly? ... View more

TYVM Rich! If I needed to add a macro in the search, where would I place that? Thx again ... View more

TYVM! ... View more

Verified with Splunk support that setting the time zone in props in combination with setting time zone preference in GUI is correct ... View more

So just checked preferences for my account in Splunk Cloud and no default was set so I changed that to GMT/Eastern Time and now when I search the events they have the correct time. Just making sure this is the fix ... View more

Thx for the solution! ... View more

TYVM as that solved the issue - I was messing around with the | addtotals command but just had it in the wrong place Thx again! ... View more