index="unix"
| stats count() by tspan(_time, 1h)

index="unix"
| stats count() as total by tspan(_time, 1h) as date

index="event"
| times earliest=-24h@h latest=now
| where isnotnull(device_ip)
| stats count() by _time, device_ip, event_name, event_level
| sort - _time
| head 100
| lookup asset.csv ip as device_ip OUTPUT application_name

(index="unix" action="Failed password") OR (index="windows" id="4625")
| times earliest=-24h@h latest=now
| rename account_name as user
| stats count() as totals by user
| sort - totals
| head 10

index="firewall" action="deny"
| times earliest=-7d@d latest=now
| stats count() as hits by src_ip
| sort - hits
| head 20
| lookup asset.csv ip as src_ip OUTPUT application_name, owner

index="proxy"
| eval low_user = lower(username)
| eval is_ok = if(status_code == 200, "Y", "N")
| where is_ok="N"
| table _time, low_user, status_code, url

index="firewall"
| iplocation src_ip allfields=true prefix="geo_" lang="CN"
| stats count() by geo_country_name, geo_city_name
| sort - count()
| head 50

index="unix"
| sort _time
| stats earliest(src_ip) as first_ip, latest(action) as last_action by user

index="firewall" AND action="deny"
| where cidrmatch(src_ip, "10.0.0.0/8")
| table _time, src_ip, dest_ip, dest_port, action
| sort - _time
| head 200