Document creation time index="document_metadata" CreateDate="*" | eval document_created=case( match(CreateDate, "^\d{4}:\d{2}:\d{2} \d{2}:\d{2}:\d{2}[-\+]\d{2}:\d{2}"), strptime(CreateDate, "%Y:%m:%d %H:%M:%S%:z") ) | eval _time=document_created | bucket _time span=1d | timechart span=1d dc(FileName) as documents 0 Document modification time index="document_metadata" ModifyDate="*" | eval document_modified=case( match(ModifyDate, "^\d{4}:\d{2}:\d{2} \d{2}:\d{2}:\d{2}[-\+]\d{2}:\d{2}"), strptime(ModifyDate, "%Y:%m:%d %H:%M:%S%:z") ) | eval _time=document_modified | bucket _time span=1d | timechart span=1d dc(FileName) as documents 0 Top 20 software used index="document_metadata" | eval software=mvappend(Creator, Producer) | mvexpand software | where NOT match(software, "^\W+$") | top limit=20 software 0 Software used index="document_metadata" | eval software=mvappend(Creator, Producer) | mvexpand software | where NOT match(software, "^\W+$") | stats dc(FileName) as count by software | sort -count 0
Top 20 document authors sourcetype="_json" | top limit=20 Author 0 index="document_metadata" Author="*" | stats count(FileName) as count by Author | sort -count 0
Top 20 usernames index="document_metadata" | regex Author="^[a-z]{3,}\.[a-z]{3,}$" | top limit=20 Author 0 Usernames found in documents index="document_metadata" | regex Author="^[a-z]{3,}\.[a-z]{3,}$" | stats dc(FileName) as count by Author 0
MIMETypes index="document_metadata" | stats count by MIMEType 0 Comments embedded in documents index="document_metadata" Comments!=""| table FileName, Comments 0
Emails sourcetype="_json" | rex field=_raw "(?<email>[-\w._]+@[-\w._]+)"| search email!=""| table FileName, email 0
File paths index="document_metadata" | rex field=_raw "\"(?<file_path>(\\\\\\\\|/)([-a-zA-Z _\.]+(/|\\\\)){2,}[^\"]+)\"" | where file_path!="*" | table FileName, file_path 0
Top 20 document keywords index="document_metadata" Keywords!="" | eval keyword=case( isstr(Keywords) and like(Keywords, "%, %"), split(Keywords, ", "), isstr(Keywords), split(Keywords, " "), 1=1, Keywords ) | mvexpand keyword | regex keyword!="^\W+$" | stats count as kw_count by keyword | sort 20 -kw_count 0 Keywords in documents index="document_metadata" Keywords!="" | eval keyword=case( isstr(Keywords) and like(Keywords, "%, %"), split(Keywords, ", "), isstr(Keywords), split(Keywords, " "), 1=1, Keywords ) | mvexpand keyword | regex keyword!="^\W+$" | stats dc(FileName) as count by keyword | sort -count 0