Matt Sullivan
- Total activity 53
- Last activity
- Member since
- Following 0 users
- Followed by 0 users
- Votes 0
- Subscriptions 30
Activity overview
Latest activity by Matt Sullivan-
Matt Sullivan commented,
Official comment sorry for delay, just spotted this one. not sure if true for every version of windows, but downloaded is eventcode 17 from the update client. this event can have multiple patches that need to be in...
-
Matt Sullivan commented,
Official comment Make sure you're in edit mode when changing the time range, e.g. click the pencil icon at top of the screen, and save after adjusting the time ranges so they become the defaults.
-
Matt Sullivan commented,
Official comment if by total, you mean within the timeslice, and you are only alerting based on the count, no longer using outlier's standard deviation approach, just replace the outlier line with| where _count >...
-
Matt Sullivan commented,
Official comment Sorry for delay. Long answer here. Bear with me. 1. Using lookup today works only vs. individual IPs, not ranges. Idea 1834 is one you can upvote which would make range lookups easier. 2. there is...
-
Matt Sullivan commented,
Official comment there is a hex to decimal conversion operator https://help.sumologic.com/05Search/Search-Query-Language/Search-Operators/hexToDec also hex to ASCII : https://help.sumologic.com/05Search/Search-Qu...
-
Matt Sullivan commented,
Official comment there is a hex to decimal conversion operator https://help.sumologic.com/05Search/Search-Query-Language/Search-Operators/hexToDec also hex to ASCII : https://help.sumologic.com/05Search/Search-Qu...
-
Matt Sullivan commented,
Official comment assuming you want to just show results from category1 where Id from category 2 is present, you might opt to move the subquery to the scoping portion of the query, and presuming category1 does not h...
-
Matt Sullivan commented,
Official comment this could be any number of conditions, I would highly recommend getting a support case open for this one.
-
Matt Sullivan commented,
Official comment prob best to split the Time into its parts, then you have an actual integer where compares work, e.g. | split Time delim=':' extract 1 as hh, 2 as mm, 3 as ss| where hh > 15 and hh < 23 hope...
-
Matt Sullivan commented,
Official comment Sorry for the delay answering. We're frequently adding to our offerings on Azure (as well as AWS and GCP) so this answer may become outdated and I would recommend perusing the release notes from ti...