faststeak

index=firewall sourcetype="cisco:acs" eventtype=cisco_acs_auth_events
| streamstats values(message) as message by message_id
| eval message=mvjoin(message, ",")
| stats values(UserName) as UserName values(User_Name) as User_Name values(Called_Station_ID) as Called_Station_ID by Calling_Station_ID

faststeak

| rest splunk_server=local /services/deployment/server/applications
| fields title id serverclasses
| where isnotnull(serverclasses)
| mvexpand serverclasses

faststeak

| rest splunk_server=local /services/deployment/client/config
| fields serverClasses
| mvexpand serverClasses
| rex field=serverClasses "(?<serverClass>[^:]+):(?<app>\S+)"
| fields serverClass app

faststeak

| tstats summariesonly=t dc(Authentication.dest) from datamodel=Authentication.Authentication by Authentication.user,_time span=5m
| `drop_auth_dm`
| eventstats avg("dc(Authentication.dest)") as avg stdev("dc(Authentication.dest)") as stdev by "user"
| eval lowerBound=(avg-stdev*exact(2)), upperBound=(avg+stdev*exact(4))
| eval isOutlier=if('dc(Authentication.dest)' < lowerBound OR 'dc(Authentication.dest)' > upperBound, 1, 0)
| search isOutlier=1
| eval myTime=relative_time(now(), "-15m@m")
| eval time=_time
| where time>=myTime
| fields - avg,lowerBound,myTime,time

faststeak

| tstats summariesonly=t dc(Authentication.dest) AS Unique_Destinations from datamodel=Authentication.Authentication WHERE NOT [|inputlookup high_volume_auth_whitelist.csv | rename user AS Authentication.user] by Authentication.user
| `drop_auth_dm`
| search  Unique_Destinations>20

faststeak

| rest splunk_server=local /services/deployment/server/clients 
| fields applications.*, title,clientName, dns, ip, instanceName 
| foreach applications.*.archive 
    [ eval apps=mvappend(apps, '<<FIELD>>')]
| foreach applications.*.serverclasses
    [ eval serverClass=mvappend(serverClass, '<<FIELD>>')]
| fields apps, serverClass, title, clientName, dns, ip, instanceName
| rex field=apps max_match=100 "(?<app_name>[^\/]+)-\d+\.bundle" 
| fields - apps 
| stats dc(app_name) values(*) AS * by title

faststeak

| tstats count where index=* AND source="/data/syslog/raw/*"  by _time sourcetype host span=1m
| streamstats avg(count) as events_avg time_window=1m 
| eventstats median("events_avg") as median p25("events_avg") as p25 p75("events_avg") as p75  by "host", "sourcetype" 
| eval IQR=(p75-p25) 
| eval lowerBound=(median-IQR*exact(3)), upperBound=(median+IQR*exact(3))
| eval isOutlier=if('events_avg' < lowerBound, 1, 0) 
| `splitby("host", "sourcetype")` 
| fields _time, "events_avg", lowerBound, upperBound, isOutlier, *
| search isOutlier=1
| stats latest(isOutlier) as isOutlier by _time host sourcetype

faststeak

index=msad earliest=-1y sourcetype=activedirectory Computer 
| makemv delim="|" objectClass 
| search objectClass=computer 
| makemv delim="|" memberOf 
| makemv delim="|" servicePrincipalName
| stats last(objectClass) as objectClass last(distinguishedName) as distinguishedName last(sAMAccountName) as sAMAccountName last(cn) as cn last(userAccountControl) as userAccountControl last(isDisabled) as isDisabled last(isDeleted) as isDeleted last(whenChanged) as whenChanged last(whenCreated) as whenCreated last(dNSHostName) as dNSHostName last(operatingSystem) as operatingSystem by objectSid
| search isDeleted=True
| eval nt_host=if(like(operatingSystem,"Windows%"), (upper(substr(sAMAccountName, 1, len(sAMAccountName)-1))), null)

faststeak

index=osquery sourcetype=osquery:interface* NOT address=127.0.0.1 NOT address="::1" NOT mac=00:00:00:00:00:00 | stats values(address) as address values(mac) as mac by host interface | mvexpand mac |

faststeak

index=_internal source=*metrics.log earliest=-1h  group=per_host_thruput series="<your_host>" component=Metrics 
| timechart span=1m avg(eps) as avg_eps

# Another try:

| metasearch index=<your_index>   host=<your host>  | streamstats count as s_count time_window=1m | timechart span=1m@m avg(s_count) as avg_count