Hi
I have run the following search ( Endpoint - Malware Daily Count - Context Gen) verified from a couple of different sources, and get the above mentioned error message....any advice?
| tstats `summariesonly` dc(Malware_Attacks.signature) as infection_count from datamodel=Malware.Malware_Attacks
where earliest=-31d@d latest=-1d@d Malware_Attacks.action=allowed by Malware_Attacks.dest,_time
span=1d | stats sum(infection_count) as total_infection_count by _time
| stats count,median(total_infection_count) as median by _time
| eval min=0 | eval max=median*2 | xsCreateDDContext name=count_1d container=malware type=domain
terms="minimal,small,medium,large,extreme" scope=app app=SA-NetworkProtection | stats count
↧