Stan Bradley
| append [| inputlookup append=t unmanaged_higher.csv in which cid=* MACPrefix!=none LocalAddressIP4=* LocalAddressIP4!=nothing | rename ComputerName Once the “Last Discover By”| append [ inputlookup append=t unmanaged_med.csv where cid=* MACPrefix!=none LocalAddressIP4=* LocalAddressIP4!=nothing | rename ComputerName Just like the “Past Located Of the”]| append [| inputlookup append=t unmanaged_reasonable.csv in which cid=* MACPrefix!=nothing LocalAddressIP4=* LocalAddressIP4!=not one | rename ComputerName Because the “Last Found Because of the”] | append [| inputlookup notsupported.csv where cid=* MACPrefix!=none LocalAddressIP4=* LocalAddressIP4!=none | rename ComputerName Since “History Located From the” ] | eval “Past Viewed (UTC)”=strfdate(_date, “%m/%d/%y %I:%M%p”) | fillnull value=null assistance | eval LocalAddressIP4=mvsort(mvdedup(split(LocalAddressIP4,” “))) | eval discoverer_support=mvsort(mvdedup(split(discoverer_services,” “))) | eval aip=mvsort(mvdedup(split(aip,” “))) | sort 0 -“Past Viewed (UTC)” | lookup oui.csv MACPrefix Productivity Name brand, ManufacturerAddress | fillnull worthy of=NA Manufacturer | eval Name brand=if(Manufacturer=”NA”,InterfaceDescription,Manufacturer) ]
|head a hundred |statistics matter earliest(_time) since the very first of the username sourcetype | eval earliest=strftime(basic,”%m/%d/%y %H:%M:%S”) | eval username=lower(username) | statistics count because of the login name sourcetype basic | dedup login name
| inputlookup managedassets.csv | eval “History Seen (UTC)”=strfdate(_go out, “%m/%d/%y %I:%M%p”) | type 0 -“Past Seen (UTC)” | research oui.csv MACPrefix Yields Company | fillnull value=NA Company | eval Brand name=if(Manufacturer=”NA”,InterfaceDescription,Manufacturer)
| join help [| inputlookup assistance_learn where cid=* | eval “History Seen (UTC)”=strfgo out(_date, “%m/%d/%y %I:%M%p”) | type 0 -“Past Viewed (UTC)” | look oui.csv MACPrefix Yields Company | fillnull worth=NA Brand name | eval Company=if(Manufacturer=”NA”,InterfaceDescription,Manufacturer) | dedup aid]