tag:blogger.com,1999:blog-55818361783060748252024-03-27T02:35:26.882-04:00Mark Runals' BlogSome sort of Data/SIEM/InfoSec blog.Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.comBlogger106125tag:blogger.com,1999:blog-5581836178306074825.post-77706988108741984292023-11-04T14:18:00.006-04:002023-11-22T10:08:06.597-05:00CQLing Game Data - The Blog Version<p>I've been learning CrowdStrike's LogScale platform recently. To help myself learn the CrowdStrike Query Language (CQL) I figured I'd do some analysis of game data I had collected awhile ago. Help me learn and then create this post to perhaps help others who might be learning CQL as well. </p><p>That end, this post is a more written version of the live & somewhat interactive LogScale dashboard located: <a href="https://cloud.community.humio.com/shared/dashboards?token=4ASsjdpRBdtlKY4Q6OHQ4d6z&theme=light"><b><span style="color: #2b00fe;">here</span></b></a>. </p><p>I'm providing the data itself at the bottom of this post if you want to monkey around with it.</p><p>It isn't uncommon for users of tools like LogScale to not know where to start from a query perspective. Something unique with LogScale is being able to easily share dashboards outside of the tool itself. This is a pretty cool capability! The other place where I see individuals somewhat struggle is how to create a dashboard. Not mechanically as much as how to lay out data. </p><span><a name='more'></a></span><p>I should note the way I structured both my queries and the eventual dashboard should not be considered the 'right' way to do things. As with any language there are often multiple ways to achieve the same outcome. Start by making sure you are displaying the data you think you are displaying and then work toward efficiencies. As you gain experience that efficiency starts to be baked into your initial query creation.</p><p>A great CQL primer can be found: <a href="https://www.reddit.com/r/crowdstrike/comments/11zojds/20230323_cool_query_friday_logscale_the_basics/">here</a></p><p>My original Splunk version of this post: <a href="https://runals.blogspot.com/2021/01/splunking-game-data-darkfire-heroes.html">here</a></p><p>Feel free to jump between the two posts to do a comparison of the query languages. That's fine as folks might have a Splunk frame of reference. I might even call out a few things here and there. What I'm not trying to do with this post is to say one tool is better than the other. </p><p><b>Data Background </b>- there used to be this great little mobile game called Darkfire Heroes. One of the game modes was a 1v1 PvP match. They once did a 2 day PvP event to see which clans would get the most wins. Outside of the event itself, each clan could 'fill' a weekly rewards chest through any PvP win. Participation in the event then is a 2fer! As a side note, clans could hold up to 50 people. I should mention this data was manually collected and needed to be collected prior to the event's end. There are some gaps in terms of player names, all clan names, all clan participation, etc.</p><p><b>Analytic Goals</b> - putting yourself in the shoes of a game admin or owner is not too much different that being a system admin (conceptually). In my case I'd want to do know things like</p><p></p><ul style="text-align: left;"><li>What does participation overall look like?</li><li>What clans are fully active and what does that drop off look like?</li><li>Was the event enough of a driver to have clans fill their clan rewards chest?</li><li>How full are clans?</li><li>And then fun things like looking at the top 10 and comparing activity to the rest of the game dataset. That last part is beyond what I have of course.</li></ul><p></p><p>Let's begin!</p><p>Oh I should note since I didn't ingest this data and LogScale doesn't currently have a way to simply pull up an uploaded CSV, I created a search with the raw data, saved it, and then call up that search as a function [ ie save the query as dfh_clan efforts then start a separate query with $dfh_clan_efforts() ]. </p><p><b>1. Total Clans Participating</b></p><div style="text-align: left;"><span style="color: #2b00fe;">createEvents(["236"]) <br />| select(@rawstring)</span></div><p>Creating events in LogScale feels a bit different to me than in Splunk. I'm not sure why TBH. I think because the entire event is captured in the command itself. In Splunk you use makeevent, add an eval for the strings, and then break the string up if you are creating multiple events. Either language, you probably wont be using the command much. Here I just need to call out there was 236 clans. Don't give me grief - I manually collected the data I do have! </p><p><b>2. Total Matches Played</b></p><div style="text-align: left;"><span style="color: #2b00fe;">$dfh_clan_leaderboard() <br />| sum(wins, as=wins) <br />| games := wins * 2 <br />| drop([wins]) </span></div><p>Since the game showed just wins I needed to swag how many games were actually played. I was pretty generous and applied an across the board 50% win average (note line 3). This isn't quite a <a href="https://en.wikipedia.org/wiki/Fermi_problem#:~:text=Fermi%20problems%20typically%20involve%20making,be%20derived%20using%20dimensional%20analysis.">fermi problem</a> but for us it moves the needle. Ironically when I was reviewing my Splunk post I realized I posted the wrong output number in the screenshot. Whoops.</p><p>I'll call out the assignment operator ( := ) as an interesting bit with CQL. While there is an eval command, this can serve as a substitute or shorthand of that function. I found myself using it a lot.</p><p><b>3. Clan Chests Filled</b></p><div style="text-align: left;"><span style="color: #2b00fe;">$dfh_clan_leaderboard() <br />| wins > 1000 <br />| count() </span></div><p>It actually took 1,186 PvP wins to fill a clan rewards chest but I collected my data a few hours before it ended so gave people the benefit of the doubt. Folks will note that you can simply drop filter statements as you go. You can also use boolean logic in the filter statements though given the small dimensionality of my data I don't do that in any of my queries. For example Diable2 and SpawnsofDiablo were separate clans but were related as a 'clan family.' If I wanted to pull them up together in this query I could have done</p><p><span style="color: #2b00fe;">| wins > 1000 clan=*Diablo*</span></p><p>Note searching field values in CQL is case sensitive and luckily both clans used a capital D. Since I don't use any regex stuffs in my queries I'll bring up a few things here. I could have invoked the regex engine and told it to look for the string "diablo" in a case insensitive manner like this</p><p><span style="color: #2b00fe;">| wins > 1000 clan=/diablo/i</span></p><p>Note the forward slashes and the lower case i at the end. If I wanted to pull up the Diablos and say, LegendsOnly I could do any of the following to include a regex OR.</p><p><span style="color: #2b00fe;">| wins> 1000 clan=*Diablo* or clan=LegendsOnly</span></p><div style="text-align: left;"><span style="color: #2b00fe;">| wins> 1000 <br /></span><span style="color: #2b00fe;">| in(field=clan, values=[*Diablo*, LegendsOnly])</span></div><p><span style="color: #2b00fe;"></span></p><p><span style="color: #2b00fe;">| wins> 1000 clan=/(diablo|legendsonly)/i</span></p><p>What I don't know is if there is any value in doing (?:diablo|legendsonly) vs (diablo|legendsonly). </p><p><b>4. Clan Wins and Percent of Total Battles</b></p><div style="text-align: left;"><span style="color: #2b00fe;">$dfh_clan_leaderboard()<br />| foo := "x"<br />| groupBy([foo], function=[sum(wins, as = totalWins), groupBy([clan], function=collect([wins]))])<br />| percOfTotalWins := (wins/totalWins)*100<br />| round("percOfTotalWins")<br />| table([clan, wins, totalWins, percOfTotalWins], sortby=percOfTotalWins)</span></div><p>Here is where I saw a delta between CQL and SPL - eventstats. I love me some eventstats! I'm not sure how frequently it is used by the average Splunker /shrug. It lets you create statistical evaluations across your dataset as a new field - like stats and eval had a baby. In CQL you can nest groupBy statements within groupBy statements. GroupBy is largely a SPL stats equivalent. TBH I'm still wrapping my head around the nesting bit. </p><p>The use case here is pretty simple - I want to have my query count the total number of wins so I can determine individual clan percent. Since I didn't have a secondary field to aggregate across all events, I created a new field that would be applied to all events (foo). Then within that same groupBy I simply pulled out the individual clan wins (collect ~ splunk stats values). There might be a better way to do what I did?</p><p>I'll call out then if you want your groupBy to do multiple functions or evaluations, you need to wrap your function in square brackets. Square brackets in CQL let the engine know it is dealing with an array. You will use this a good bit - for example look at the table command here. </p><p><b>5. Clan Wins as Percent of Total Battles - the Pie Version</b></p><div style="text-align: left;"><span style="color: #2b00fe;">$dfh_clan_leaderboard()<br />| drop([finish_position, members])</span></div><p>Conceptually panel 4 and 5 are the same. I wanted to go through the gyrations in panel 4 to highlight how you can process the data. Here I'm simply calling up the data, keeping what I want, and by pivoting to a Pie chart letting the engine do the work. </p><p><b>6 a&b - Contributors Relative to Wins</b></p><div style="text-align: left;"><span style="color: #2b00fe;">$dfh_clan_leaderboard()<br />| join(query={ $dfh_clan_efforts() | wins > 0 | groupBy([clan], function=count(as = contributors)) }, field=[clan], include=[contributors], mode=left)</span></div><p>I really liked how the Splunk version of this turned out as I'm effectively looking at 4 dimensions of data at once. Splunk is also 20 yrs old this year and has a ton of iterative development.</p><p>What I'll highlight here from a visualization standpoint is with LogScale, as of this time, in order to use a bar chart you will need to use a groupBy statement in your query. You can't simply take the same data in tabular form and use that visualization. I thought about trying a scatter plot but wanted to keep the posts relatively the same for the 1s and 1s of readers who find this let alone flip back and forth between the SPL and CQL version of this post.</p><p>I will call out how I brought the two datasets together via join. I didn't use the CQL match command as I needed to perform some calculations before merging the data. I'm also doing a left, or outer, join vs inner. The difference is inner joins (regardless of language) are used when you want to only show results where results are the same. Left joins are when you still want to see all of the data from the initial portion of your query.</p><p><b>7 & 8 - Clan Chest Filled Distribution</b></p><div style="text-align: left;"><span style="color: #2b00fe;">$dfh_clan_leaderboard()<br />| full_chest := 1186<br />| perc_filled := (wins/full_chest)*100<br />| case{perc_filled >= 100 | perc_filled := 100; * | round(perc_filled)}<br />| case{ perc_filled >= 90 | foo := "01. 90-100"; perc_filled >=80 | foo := "02. 80-89"; perc_filled >= 70 | foo := "03. 70-79" ; perc_filled >= 60 | foo := "04. 60-69"; perc_filled >=50 | foo := "05. 50-59"; perc_filled >=40 | foo := "06. 40-49"; perc_filled >= 30 | foo := "07. 30-39"; perc_filled >=20 | foo := "08. 20-29" ; perc_filled > 10 | foo := "09. 10-19"; perc_filled >=0 | foo := "10. 0-9" ; * | foo := "fixme"}<br />| groupBy([foo], function=count(clan))<br />| sort(foo, order=asc)</span></div><p>Both of these panels are using the same query. I'm doing something here I like doing but haven't figured out a good way to explain. In effect find a value and then explore that value from a bucketized frequency perspective. Help? No? How about this</p><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWopEuPaTrTgEtqTu_Nqh68lHlzYwBTlhPenVP67rPTsKTXHQJUz7gyoOaUu8iwQqKuBDydrbWp4MJ-YvruJ6WE8YKyLnK6E2UFbmtRz2q4kVqnpZi8-_SrN-ivQsHZ0oyvfmQAoq-Lkdt1RubYWs62j_ZUu4TTPhjo20T3H_YHVuQ7f6ptV8ao6d38pL5/s492/panel7.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="172" data-original-width="492" height="140" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWopEuPaTrTgEtqTu_Nqh68lHlzYwBTlhPenVP67rPTsKTXHQJUz7gyoOaUu8iwQqKuBDydrbWp4MJ-YvruJ6WE8YKyLnK6E2UFbmtRz2q4kVqnpZi8-_SrN-ivQsHZ0oyvfmQAoq-Lkdt1RubYWs62j_ZUu4TTPhjo20T3H_YHVuQ7f6ptV8ao6d38pL5/w400-h140/panel7.png" width="400" /></a></div><div><br /></div><p style="text-align: left;">I first define how many wins fill a chest then figure out, from the 2 day PvP wins, how filled individual clan's chest would be as a percentage (perc_filled), Now I want to bucketize across the dataset the clan perc_filled (foo) to then aggregate on that field. In other words, how many clans fully filled their chest, how many filled it less than 10%, etc. I want to bucketize this as visually parsing 10 data points is often better than all data points. In my case that is only 236 but what if it were a million? I've arbitrability picked 10, it could have been 5 or 20 or whatever.</p><p style="text-align: left;">A sharp eye will note nuances of case statements: the use of curly brace, pipes, and semicolons. For those that don't otherwise know, when you use case statements an event is evaluated left to right. As soon as an argument evaluates as true it breaks out of the evaluation. This is why I can walk down numerically with my greater than symbols.</p><p style="text-align: left;">The reason the 'foo' buckets look goofy is I wanted to display the buckets I had created in a particular order. Many engines have sorting issues when you combine character, integer, and special characters. I prepended my order to help the sorting portion of the code. </p><p style="text-align: left;">I was somewhat surprised the pie chart would only display in descending % but that is what it is I guess. I also wanted to highlight here how you can open up the inner radius of the pie which is kinda neat if you are into that look.</p><p style="text-align: left;"><b> 9. Member Participation</b></p><div style="text-align: left;"><span style="color: #2b00fe;">$dfh_clan_efforts() <br />| wins > 0<br />| groupBy([clan], function=[sum("wins", as=clan_wins), count(clan_member, distinct=true, as=contributing_members), avg(wins, as=avgMemberWins)])<br />| round("avgMemberWins")<br />| match(file="clan_leaderboard.csv", field="clan", strict=false)<br />| table([clan, finish_position, clan_wins, contributing_members, avgMemberWins], sortby=clan_wins, order=desc)<br />| default(value="null", field=[finish_position])<br />| case{ finish_position="null" | finish_position := 60; * | finish_position := finish_position }</span></div><div style="text-align: left;"><br /></div><div style="text-align: left;">I'm flipping over to the individual contribution dataset here to see how many members participated and show that relative clan finish position. This is interesting to me from the perspective of who is pulling their weight? I'm similarly interested in knowing what the average wins across participating members. Honestly averages are overrated and box plot type numbers are the better way to go. Or at least look at the average and the median. Those are separate discussions though. </div><p style="text-align: left;">In my match statement you will see <span style="color: #2b00fe;">strict=false</span>. This is somewhat similar to a left join in that I want to keep my original dataset even if there isn't a match from the secondary csv I'm pulling in. On that note I did upload the actual csv into LogScale in the Files portion of my Repo's nav bar. The use of match can allow users to enrich data with a static dataset. You just can't pull up that dataset within a search on its own.</p><p style="text-align: left;">Because of how I collected the data there is a hole in the finish position for Valhalla. The last two lines of the query adjust the data for that. I haven't found a clean way to identify and work with nulls in LogScale yet other than this two stepper. In this case 'default' operates like Splunk's fillnull.</p><p style="text-align: left;"><b>10 - Top 10 Hitters and Clan Representation</b></p><div style="text-align: left;"><span style="color: #2b00fe;">$dfh_clan_efforts()<br />| sort(wins, order=asc, limit=20000)<br />| table([clan, clan_member, wins], sortby=wins, order=desc, limit=10) | join(query={$dfh_clan_efforts() | table([clan, clan_member, wins], sortby=wins, order=desc, limit=10) <br />| groupBy([clan], function=count(as="clan representation"))}, field=[clan], include="clan representation")<br />| table([clan, clan_member, "clan representation", wins])</span></div><p>The first part is straight forward enough - show me the top 10 individual finishers/contributors. The default for LogScale's sort function is only 200. An order of magnitude here is a bit high but I wanted to figure out what the max is was/currently is.</p><p>Now I want to see how many in the top 10 were in the same clan AND I wanted to display the data like I am. I tried multiple times with nested groupBy statements but nothing worked for me. That's fine, I'll use join. You'll see the joined query looks pretty similar to the first search - get the top 10 finishers, then do a count by clan. With joins you need to include an 'include' argument to tell LogScale what you are looking to bring over. Then its just a matter of using table to display the data in the filed order I want.</p><p>That's it! </p><p>Hopefully people find this valuable. If you have questions, comments, or alternate queries I'm all ears!</p><p>I suppose I haven't really talked about the dashboard layout itself. As a personal taste thing I like to start with high level aggregations at the top with both widget size and granularity increasing as you work down. For me that helps set the stage and as I start wondering about some of the granularities they start to become apparent. Separately I like telling folks that especially for singular dashboard panels try to think about what the audience's first question will be and work to answer that. My goto is something like failed auth. It's great that you can generate a list of people with the highest numbers of failed authentications. A security analyst will now want to know things like was that on one system or many, did it happen all at once or over time, is it still going on? Try to develop your singular panels or if you are using a full dashboard to answer those questions vs making the analyst go somewhere else to find them out. Saves time and hassle.</p><p><b>Raw data</b> - copy/paste these into your LogScale instance, then save them as searches.</p><p><b>Individual efforts</b></p><div style="background-color: #fffffe; font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace, Consolas, "Courier New", monospace; font-size: 14px; line-height: 19px; white-space: pre;"><div><span style="color: blue;">createEvents</span>([<span style="color: #a31515;">"Diablo2,Diablo2_1,504"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_2,500"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_3,349"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_4,335"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_5,222"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_6,209"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_7,177"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_8,152"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_9,137"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_10,129"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_11,124"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_12,118"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_13,116"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_14,102"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_15,85"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_16,78"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_17,75"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_18,74"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_19,67"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_20,59"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_21,56"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_22,56"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_23,56"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_24,52"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_25,51"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_26,51"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_27,49"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_28,43"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_29,41"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_30,39"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_31,34"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_32,31"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_33,28"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_34,24"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_35,24"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_36,18"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_37,17"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_38,16"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_39,14"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_40,9"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_41,8"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_42,5"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_43,5"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_44,3"</span>,</div><div><span style="color: #a31515;">"Diablo2,Diablo2_45,1"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_1,488"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_2,307"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_3,272"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_4,266"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_5,199"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_6,171"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_7,166"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_8,161"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_9,151"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_10,138"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_11,130"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_12,120"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_13,110"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_14,103"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_15,98"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_16,80"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_17,78"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_18,72"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_19,62"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_20,53"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_21,51"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_22,49"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_23,49"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_24,48"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_25,44"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_26,38"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_27,32"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_28,32"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_29,27"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_30,27"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_31,26"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_32,24"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_33,23"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_34,23"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_35,22"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_36,21"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_37,17"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_38,13"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_39,13"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_40,11"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_41,11"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_42,11"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_43,9"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_44,9"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_45,8"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_46,5"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_47,3"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_48,2"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,SpawnsofDiablo_49,0"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_1,560"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_2,399"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_3,190"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_4,147"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_5,131"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_6,102"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_7,89"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_8,77"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_9,53"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_10,52"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_11,49"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_12,48"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_13,43"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_14,40"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_15,38"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_16,37"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_17,37"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_18,30"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_19,27"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_20,22"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_21,19"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_22,18"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_23,17"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_24,17"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_25,16"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_26,16"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_27,16"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_28,15"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_29,15"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_30,14"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_31,14"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_32,14"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_33,12"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_34,11"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_35,9"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_36,9"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_37,9"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_38,9"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_39,8"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_40,7"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_41,7"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_42,7"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_43,7"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_44,7"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_45,4"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_46,4"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_47,4"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_48,3"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_49,3"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,LegendsOnly_50,0"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_1,167"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_2,66"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_3,58"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_4,50"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_5,33"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_6,29"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_7,27"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_8,24"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_9,21"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_10,21"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_11,19"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_12,16"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_13,15"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_14,13"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_15,12"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_16,12"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_17,11"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_18,11"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_19,11"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_20,10"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_21,10"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_22,8"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_23,7"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_24,7"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_25,6"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_26,6"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_27,6"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_28,6"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_29,5"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_30,5"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_31,5"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_32,4"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_33,3"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_34,3"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_35,2"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_36,2"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_37,2"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_38,2"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_39,1"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_40,1"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_41,0"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_42,0"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_43,0"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_44,0"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_45,0"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_46,0"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_47,0"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_48,0"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_49,0"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,Worldwarriors_50,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_1,23"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_2,21"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_3,21"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_4,20"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_5,19"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_6,17"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_7,16"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_8,12"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_9,11"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_10,10"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_11,10"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_12,9"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_13,9"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_14,8"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_15,8"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_16,7"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_17,7"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_18,7"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_19,7"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_20,7"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_21,6"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_22,5"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_23,5"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_24,5"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_25,4"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_26,4"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_27,3"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_28,1"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_29,1"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_30,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_31,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_32,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_33,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_34,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_35,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_36,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_37,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_38,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_39,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_40,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_41,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_42,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_43,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_44,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_45,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_46,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_47,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_48,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_49,0"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,ColoradoCasual_50,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_1,34"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_2,30"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_3,25"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_4,14"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_5,13"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_6,11"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_7,11"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_8,8"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_9,7"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_10,5"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_11,4"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_12,3"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_13,2"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_14,2"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_15,2"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_16,2"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_17,2"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_18,2"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_19,1"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_20,1"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_21,1"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_22,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_23,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_24,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_25,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_26,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_27,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_28,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_29,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_30,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_31,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_32,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_33,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_34,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_35,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_36,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_37,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_38,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_39,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_40,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_41,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_42,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_43,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_44,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_45,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_46,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_47,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_48,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_49,0"</span>,</div><div><span style="color: #a31515;">"Armyofall,Armyofall_50,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_1,17"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_2,16"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_3,14"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_4,11"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_5,10"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_6,7"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_7,7"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_8,3"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_9,3"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_10,2"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_11,2"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_12,2"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_13,2"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_14,2"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_15,1"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_16,1"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_17,1"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_18,1"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_19,1"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_20,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_21,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_22,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_23,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_24,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_25,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_26,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_27,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_28,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_29,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_30,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_31,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_32,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_33,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_34,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_35,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_36,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_37,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_38,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_39,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_40,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_41,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_42,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_43,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_44,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_45,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_46,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_47,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_48,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_49,0"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,HordSmashers_50,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_1,14"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_2,14"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_3,10"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_4,8"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_5,7"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_6,5"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_7,4"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_8,3"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_9,3"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_10,3"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_11,3"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_12,2"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_13,1"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_14,1"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_15,1"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_16,1"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_17,1"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_18,1"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_19,1"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_20,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_21,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_22,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_23,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_24,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_25,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_26,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_27,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_28,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_29,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_30,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_31,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_32,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_33,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_34,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_35,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_36,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_37,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_38,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_39,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_40,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_41,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_42,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_43,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_44,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_45,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_46,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_47,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_48,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_49,0"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,SinCityKnights_50,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_1,10"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_2,9"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_3,9"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_4,8"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_5,6"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_6,4"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_7,2"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_8,2"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_9,2"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_10,2"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_11,2"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_12,1"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_13,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_14,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_15,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_16,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_17,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_18,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_19,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_20,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_21,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_22,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_23,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_24,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_25,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_26,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_27,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_28,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_29,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_30,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_31,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_32,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_33,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_34,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_35,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_36,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_37,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_38,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_39,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_40,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_41,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_42,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_43,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_44,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_45,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_46,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_47,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_48,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_49,0"</span>,</div><div><span style="color: #a31515;">"Valhalla,Valhalla_50,0"</span>])</div><div><span style="color: #666666;">|</span> <span style="color: blue;">parseCsv</span>(columns=[<span style="color: #a31515;">"clan"</span>, <span style="color: #a31515;">"clan_member"</span>, <span style="color: #a31515;">"wins"</span>])</div><div><span style="color: #666666;">|</span> <span style="color: blue;">drop</span>([<span style="color: #a31515;">@rawstring</span>, <span style="color: #a31515;">@timestamp.nanos</span>, <span style="color: #a31515;">@timestamp</span>])</div><div><br /></div><div><b>Clan Leaderboard</b></div><div><div style="line-height: 19px;"><div><span style="color: blue;">createEvents</span>([<span style="color: #a31515;">"Diablo2,1,49,4439"</span>,</div><div><span style="color: #a31515;">"SpawnsofDiablo,2,50,3883"</span>,</div><div><span style="color: #a31515;">"LegendsOnly,3,50,2536"</span>,</div><div><span style="color: #a31515;">"Assassins,4,50,2032"</span>,</div><div><span style="color: #a31515;">"Deplorables,5,50,1119"</span>,</div><div><span style="color: #a31515;">"WeAreGroot,6,50,1018"</span>,</div><div><span style="color: #a31515;">"PlanetExpress,7,50,802"</span>,</div><div><span style="color: #a31515;">"Resurrected,8,45,770"</span>,</div><div><span style="color: #a31515;">"Worldwarriors,9,50,656"</span>,</div><div><span style="color: #a31515;">"imperialguard2,10,48,652"</span>,</div><div><span style="color: #a31515;">"Heathens,11,50,567"</span>,</div><div><span style="color: #a31515;">"Covid,12,50,450"</span>,</div><div><span style="color: #a31515;">"Sofaklanen,13,50,382"</span>,</div><div><span style="color: #a31515;">"ActiveOnly,14,50,369"</span>,</div><div><span style="color: #a31515;">"HiddenLeaf,15,50,303"</span>,</div><div><span style="color: #a31515;">"TeamQc,16,50,298"</span>,</div><div><span style="color: #a31515;">"F3ARLESS,17,50,297"</span>,</div><div><span style="color: #a31515;">"Revansheer,18,50,295"</span>,</div><div><span style="color: #a31515;">"CatchThzHandz,19,50,277"</span>,</div><div><span style="color: #a31515;">"ColoradoCasual,20,50,274"</span>,</div><div><span style="color: #a31515;">"NuBeginnings,21,50,271"</span>,</div><div><span style="color: #a31515;">"MisfitToys,22,50,270"</span>,</div><div><span style="color: #a31515;">"WolfiesClan,23,50,256"</span>,</div><div><span style="color: #a31515;">"DutchTigers,24,49,241"</span>,</div><div><span style="color: #a31515;">"ZeroFukGiven,25,50,237"</span>,</div><div><span style="color: #a31515;">"SpectralSpartans,26,50,229"</span>,</div><div><span style="color: #a31515;">"Fighters,27,50,215"</span>,</div><div><span style="color: #a31515;">"KINGSnQUEENS,28,50,206"</span>,</div><div><span style="color: #a31515;">"FerdaBoys,29,50,192"</span>,</div><div><span style="color: #a31515;">"Armyofall,30,48,165"</span>,</div><div><span style="color: #a31515;">"TurtleGang,31,50,149"</span>,</div><div><span style="color: #a31515;">"Logitek,32,50,147"</span>,</div><div><span style="color: #a31515;">"BreganDaerthe,33,44,146"</span>,</div><div><span style="color: #a31515;">"NorthernElysia,34,48,138"</span>,</div><div><span style="color: #a31515;">"WarDogz,35,48,132"</span>,</div><div><span style="color: #a31515;">"Exile,36,50,128"</span>,</div><div><span style="color: #a31515;">"Fusion,37,50,121"</span>,</div><div><span style="color: #a31515;">"TheWarForged,38,50,120"</span>,</div><div><span style="color: #a31515;">"13thLegion,39,50,102"</span>,</div><div><span style="color: #a31515;">"HordeSmashers,40,50,95"</span>,</div><div><span style="color: #a31515;">"Dreamwalkers,41,50,90"</span>,</div><div><span style="color: #a31515;">"Akatsuki,42,50,89"</span>,</div><div><span style="color: #a31515;">"DarkfireMambas,43,50,88"</span>,</div><div><span style="color: #a31515;">"Sparrago,44,50,87"</span>,</div><div><span style="color: #a31515;">"Raiders,45,50,84"</span>,</div><div><span style="color: #a31515;">"JustForFun,46,50,82"</span>,</div><div><span style="color: #a31515;">"WARHAMMER,47,50,77"</span>,</div><div><span style="color: #a31515;">"CustardSGood,48,50,76"</span>,</div><div><span style="color: #a31515;">"SinCityKnights,49,50,75"</span>,</div><div><span style="color: #a31515;">"BigChunges,50,50,74"</span>,</div><div><span style="color: #a31515;">"clan_51,51,50,70"</span>,</div><div><span style="color: #a31515;">"clan_52,52,50,69"</span>,</div><div><span style="color: #a31515;">"clan_53,53,50,66"</span>,</div><div><span style="color: #a31515;">"clan_54,54,50,65"</span>,</div><div><span style="color: #a31515;">"clan_55,55,50,64"</span>,</div><div><span style="color: #a31515;">"clan_56,56,50,60"</span>,</div><div><span style="color: #a31515;">"clan_57,57,50,59"</span>,</div><div><span style="color: #a31515;">"clan_58,58,50,57"</span>,</div><div><span style="color: #a31515;">"clan_59,59,50,56"</span>,</div><div><span style="color: #a31515;">"clan_60,60,50,54"</span>,</div><div><span style="color: #a31515;">"clan_61,61,50,53"</span>,</div><div><span style="color: #a31515;">"clan_62,62,50,53"</span>,</div><div><span style="color: #a31515;">"clan_63,63,50,51"</span>,</div><div><span style="color: #a31515;">"clan_64,64,47,49"</span>,</div><div><span style="color: #a31515;">"clan_65,65,50,48"</span>,</div><div><span style="color: #a31515;">"clan_66,66,50,48"</span>,</div><div><span style="color: #a31515;">"clan_67,67,50,47"</span>,</div><div><span style="color: #a31515;">"clan_68,68,32,42"</span>,</div><div><span style="color: #a31515;">"clan_69,69,50,40"</span>,</div><div><span style="color: #a31515;">"clan_70,70,50,39"</span>,</div><div><span style="color: #a31515;">"clan_71,71,50,38"</span>,</div><div><span style="color: #a31515;">"clan_72,72,50,38"</span>,</div><div><span style="color: #a31515;">"clan_73,73,19,37"</span>,</div><div><span style="color: #a31515;">"clan_74,74,50,36"</span>,</div><div><span style="color: #a31515;">"clan_75,75,50,36"</span>,</div><div><span style="color: #a31515;">"clan_76,76,50,33"</span>,</div><div><span style="color: #a31515;">"clan_77,77,50,33"</span>,</div><div><span style="color: #a31515;">"clan_78,78,50,33"</span>,</div><div><span style="color: #a31515;">"clan_79,79,50,32"</span>,</div><div><span style="color: #a31515;">"clan_80,80,33,30"</span>,</div><div><span style="color: #a31515;">"clan_81,81,50,29"</span>,</div><div><span style="color: #a31515;">"clan_82,82,50,29"</span>,</div><div><span style="color: #a31515;">"clan_83,83,50,29"</span>,</div><div><span style="color: #a31515;">"clan_84,84,50,27"</span>,</div><div><span style="color: #a31515;">"clan_85,85,50,26"</span>,</div><div><span style="color: #a31515;">"clan_86,86,50,25"</span>,</div><div><span style="color: #a31515;">"clan_87,87,50,25"</span>,</div><div><span style="color: #a31515;">"clan_88,88,50,25"</span>,</div><div><span style="color: #a31515;">"clan_89,89,50,24"</span>,</div><div><span style="color: #a31515;">"clan_90,90,50,21"</span>,</div><div><span style="color: #a31515;">"clan_91,91,50,20"</span>,</div><div><span style="color: #a31515;">"clan_92,92,50,20"</span>,</div><div><span style="color: #a31515;">"clan_93,93,50,19"</span>,</div><div><span style="color: #a31515;">"clan_94,94,12,18"</span>,</div><div><span style="color: #a31515;">"clan_95,95,15,17"</span>,</div><div><span style="color: #a31515;">"clan_96,96,28,16"</span>,</div><div><span style="color: #a31515;">"clan_97,97,50,16"</span>,</div><div><span style="color: #a31515;">"clan_98,98,18,16"</span>,</div><div><span style="color: #a31515;">"clan_99,99,50,16"</span>,</div><div><span style="color: #a31515;">"clan_100,100,50,16"</span>,</div><div><span style="color: #a31515;">"clan_101,101,22,16"</span>,</div><div><span style="color: #a31515;">"clan_102,102,50,16"</span>,</div><div><span style="color: #a31515;">"clan_103,103,43,15"</span>,</div><div><span style="color: #a31515;">"clan_104,104,50,15"</span>,</div><div><span style="color: #a31515;">"clan_105,105,22,15"</span>,</div><div><span style="color: #a31515;">"clan_106,106,50,15"</span>,</div><div><span style="color: #a31515;">"clan_107,107,50,15"</span>,</div><div><span style="color: #a31515;">"clan_108,108,50,14"</span>,</div><div><span style="color: #a31515;">"clan_109,109,50,14"</span>,</div><div><span style="color: #a31515;">"clan_110,110,50,14"</span>,</div><div><span style="color: #a31515;">"clan_111,111,50,14"</span>,</div><div><span style="color: #a31515;">"clan_112,112,50,14"</span>,</div><div><span style="color: #a31515;">"clan_113,113,50,14"</span>,</div><div><span style="color: #a31515;">"clan_114,114,50,14"</span>,</div><div><span style="color: #a31515;">"clan_115,115,50,13"</span>,</div><div><span style="color: #a31515;">"clan_116,116,49,13"</span>,</div><div><span style="color: #a31515;">"clan_117,117,50,13"</span>,</div><div><span style="color: #a31515;">"clan_118,118,48,13"</span>,</div><div><span style="color: #a31515;">"clan_119,119,50,13"</span>,</div><div><span style="color: #a31515;">"clan_120,120,50,12"</span>,</div><div><span style="color: #a31515;">"clan_121,121,50,12"</span>,</div><div><span style="color: #a31515;">"clan_122,122,23,12"</span>,</div><div><span style="color: #a31515;">"clan_123,123,50,12"</span>,</div><div><span style="color: #a31515;">"clan_124,124,50,12"</span>,</div><div><span style="color: #a31515;">"clan_125,125,13,11"</span>,</div><div><span style="color: #a31515;">"clan_126,126,50,11"</span>,</div><div><span style="color: #a31515;">"clan_127,127,50,11"</span>,</div><div><span style="color: #a31515;">"clan_128,128,50,11"</span>,</div><div><span style="color: #a31515;">"clan_129,129,50,11"</span>,</div><div><span style="color: #a31515;">"clan_130,130,50,11"</span>,</div><div><span style="color: #a31515;">"clan_131,131,50,10"</span>,</div><div><span style="color: #a31515;">"clan_132,132,50,10"</span>,</div><div><span style="color: #a31515;">"clan_133,133,50,10"</span>,</div><div><span style="color: #a31515;">"clan_134,134,50,10"</span>,</div><div><span style="color: #a31515;">"clan_135,135,50,10"</span>,</div><div><span style="color: #a31515;">"clan_136,136,50,10"</span>,</div><div><span style="color: #a31515;">"clan_137,137,50,10"</span>,</div><div><span style="color: #a31515;">"clan_138,138,50,10"</span>,</div><div><span style="color: #a31515;">"clan_139,139,50,9"</span>,</div><div><span style="color: #a31515;">"clan_140,140,50,9"</span>,</div><div><span style="color: #a31515;">"clan_141,141,50,8"</span>,</div><div><span style="color: #a31515;">"clan_142,142,50,8"</span>,</div><div><span style="color: #a31515;">"clan_143,143,50,8"</span>,</div><div><span style="color: #a31515;">"clan_144,144,50,8"</span>,</div><div><span style="color: #a31515;">"clan_145,145,50,8"</span>,</div><div><span style="color: #a31515;">"clan_146,146,50,8"</span>,</div><div><span style="color: #a31515;">"clan_147,147,50,8"</span>,</div><div><span style="color: #a31515;">"clan_148,148,50,8"</span>,</div><div><span style="color: #a31515;">"clan_149,149,50,8"</span>,</div><div><span style="color: #a31515;">"clan_150,150,50,7"</span>])</div><div><span style="color: #666666;">|</span> <span style="color: blue;">parseCsv</span>(columns=[<span style="color: #a31515;">"clan"</span>, <span style="color: #a31515;">"finish_position"</span>, <span style="color: #a31515;">"members"</span>, <span style="color: #a31515;">"wins"</span>])</div><div><span style="color: #666666;">|</span> <span style="color: blue;">drop</span>([<span style="color: #a31515;">@rawstring</span>, <span style="color: #a31515;">@timestamp</span>, <span style="color: #a31515;">@timestamp.nanos</span>])</div></div></div></div><p><br /></p><div><p></p><div class="separator" style="clear: both; text-align: center;"><br /></div><br /><br /><p></p><p><br /></p><p><br /></p><p><br /></p></div>Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-73053499993385305382023-08-27T20:03:00.006-04:002023-08-27T20:05:40.151-04:00Splunk to LogScale Cheatsheet<p>Learning a new language is always fun(?). Many folks start with existing paradigms and look for comparisons. I'm no different while trying to learn LogScale's Query Language or LQL. </p><p>I've looked for various cheetsheets and haven't found much. I'll paste a very rough one I've created below and hope to update it over time. Feel free to pass over anything I should add or tweak! There also has to be a better way to post this other than a pasted image from Excel. I'm a Luddite /shrug</p><span><a name='more'></a></span><p><br /></p><p></p><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/a/AVvXsEiqN_JhK24QFsBFMBeaIUXkKFhVZ6KXtSsnskYZWaSd0KapPfKtFUdSH5jY5mJfZt9uEWZbY4kbNMUhFKPh16BE5HKEmK9jEJ64xk19hSbBCYwoGSw_fpihVlM60-fT3GFbxrjK9fCbq8xutw1iKYo9XNZe9-Tb_OyrSJbyNpSSdbof-9eO7hy5PQFqghUt" style="margin-left: 1em; margin-right: 1em;"><img alt="" data-original-height="2017" data-original-width="847" height="1209" src="https://blogger.googleusercontent.com/img/a/AVvXsEiqN_JhK24QFsBFMBeaIUXkKFhVZ6KXtSsnskYZWaSd0KapPfKtFUdSH5jY5mJfZt9uEWZbY4kbNMUhFKPh16BE5HKEmK9jEJ64xk19hSbBCYwoGSw_fpihVlM60-fT3GFbxrjK9fCbq8xutw1iKYo9XNZe9-Tb_OyrSJbyNpSSdbof-9eO7hy5PQFqghUt=w509-h1209" width="509" /></a></div><br /><br /><br /><p></p><p><br /></p><p><br /></p><p></p><div class="separator" style="clear: both; text-align: center;"><br /></div><br /><br /><p></p><p><br /><br /></p>Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-25905632047169511772023-07-29T14:55:00.002-04:002023-07-29T14:55:39.075-04:00Finding Log Volume Ingestion Anomalies in Splunk<p> </p><p class="MsoNormal">This is for my man Destry who I met recently in person. He
was giving me a bit of good-natured fun at not posting more frequently. So
Destry, this is for you! <o:p></o:p></p>
<p class="MsoNormal">I’m doing a Splunk tips & tricks workshop this week with
some folks who, among other things, had asked for a query to identify log
volume anomalies. Ahh volume anomalies. So many variations of this. Several
apps can be found on Splunkbase which have been developed by the user
community. One might ask why Splunk hasn’t incorporated more of this sort of
thing in the Monitoring Console /shrug. <o:p></o:p></p>
<p class="MsoNormal">My normal recommendation to folks is run a few queries to
capture log volume (internal index license log) and event counts (tstats) in a ‘<a href="https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing" target="_blank">summary index</a>’ for long term retention and quicker analysis. Some of that is likely
found in the introspection index but I’ve not done a deep dive there TBH. The workshop I’m
doing is with folks in a multi-tenant environment where each would like to do
their own quick analysis. <o:p></o:p></p>
<p class="MsoNormal">So let’s define a few goals<o:p></o:p></p>
<p class="MsoNormal"></p><ul style="text-align: left;"><li>When a host is sending abnormally more or less of a data type
compared to other hosts</li><li>When a host is sending abnormally more or less of a data
type compared to itself</li><li>One query to do both comparisons to keep compute down and not
have intermediate steps (like populating or reading from a lookup) for
simplicity<span><a name='more'></a></span></li></ul><o:p></o:p><p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal">So how do you detect anomalous volume vs normal ebb and flow
variation? I’m not sure how standard it is but commonly people leverage the <a href="https://www.freecodecamp.org/news/normal-distribution-explained/#:~:text=The%2068%2D95%2D99%20rule&text=It%20says%3A,standard%20deviation%20of%20the%20mean." target="_blank">68-95-99 rule</a>. 95 percent of a dataset will fall within 2 standard deviations of the
mean (average). We’ll use that for the initial version of the query. Adjust
after observing the results. <o:p></o:p></p><p class="MsoNormal"><b>TLDR - the query is below</b>. After it I'll break down each section. If you have a particularly large environment you might run into limitations with eventstats. Again, summary indexing is your friend. For this version I'd run this query shortly after midnight as doing a timespan split by days will run midnight to midnight vs 24hrs from when you run your query. If you wanted to look by hour you could; you'd need to adjust some of the time snapping I use. Also based on your environment and needs, you might want to leverage the index more than I've done. A starting cron job could be <b>17 0 * * 1-5</b></p><div style="text-align: left;"><span style="color: #2b00fe;">| tstats count where index=* earliest=-8d@d latest=@d by _time index host sourcetype span=1d <br />| eval day = strftime(_time, "%w") <br />| search NOT day IN (0,6) <br />| eventstats avg(count) as avgSTDataVolume stdev(count) as stdSTDataVolume by sourcetype <br />| eventstats avg(count) as avgHostSTDataVolume stdev(count) as stdHostSTDataVolume by host sourcetype <br />| sort -_time index host sourcetype <br />| dedup index host sourcetype <br />| eval stdev_mod = 2<br />| eval avgHostSTThreshold_high = avgHostSTDataVolume + (stdev_mod * stdHostSTDataVolume) <br />| eval avgSTThreshold_high = avgSTDataVolume + (stdev_mod * stdSTDataVolume) <br />| eval avgHostSTThreshold_low = avgHostSTDataVolume - (stdev_mod * stdHostSTDataVolume) <br />| eval avgSTThreshold_low = avgSTDataVolume - (stdev_mod * stdSTDataVolume) <br />| where count > avgSTThreshold_high OR count > avgHostSTThreshold_high OR count < avgSTThreshold_low OR count < avgHostSTThreshold_low<br />| fields _time index host sourcetype count avgHostSTDataVolume avgSTDataVolume<br />| foreach avg* [ eval <<FIELD>> = round(<<FIELD>>) ]<br />| rename count as events avgSTDataVolume as "avg events for this sourcetype" avgHostSTDataVolume as "avg events for this host + sourcetype"</span></div><p class="MsoNormal">Ok so let’s start!</p><p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal">The first thing to do is grab data. Because this is going to
be a single query, we want a historical comparison, and we aren’t looking at
the content of individual events, the move is to use a tstats query. Let’s grab index host and sourcetype and split the data into
individual days. The earliest and latest designations baked into the query will
overwrite whatever you put into the time picker.<o:p></o:p></p><p class="MsoNormal"><span style="color: #2b00fe;">| tstats count where index=* earliest=-8d@d latest=@d by _time index host sourcetype span=1d </span></p>
<p class="MsoNormal">Great! Now we have 7 days of data for historical context. Because
we’ve used the span function the _time field in the query result will be
YYYY-MM-DD. Thinking ahead, I suspect we will see a fall or rise of data
volumes going into and out of a weekend. Let’s go
with pulling out the day of the week from the date using strftime and ignoring
day 0, Sunday, and day 6, Saturday.<o:p></o:p></p><p class="MsoNormal"><span style="color: #2b00fe;">| eval day = strftime(_time, "%w") </span><br style="color: #2b00fe;" /><span style="color: #2b00fe;">| search NOT day IN (0,6) </span></p>
<p class="MsoNormal">The IN operator is a great add from a few releases ago. Saves you from multiple ORs. Ok – we now need to build out what is the average and
standard deviation of the data volume by sourcetype and host + sourcetype. A simple
stats command won’t work. Eventstats to the rescue! Think of eventstats as a
fancy eval statement that allows you to do multi-line statistical calculations. Fair
warning – the field names will be long but hopefully they makes sense. Note the differences in the split by fields.<o:p></o:p></p>
<div style="text-align: left;"><span style="color: #2b00fe;">| eventstats avg(count) as avgSTDataVolume stdev(count) as stdSTDataVolume by sourcetype <br /></span><span style="color: #2b00fe;">| eventstats avg(count) as avgHostSTDataVolume stdev(count) as stdHostSTDataVolume by host sourcetype </span></div><p class="MsoNormal">What is nice is the appropriate sourcetype and host +
sourcetype calculations are on each line. For our purposes we only need the most
recent data so let’s sort the results to have the most recent day at the top. Dedup sheds the rest.<o:p></o:p></p><p class="MsoNormal"><span style="color: #2b00fe;">| sort -_time index host sourcetype </span><br style="color: #2b00fe;" /><span style="color: #2b00fe;">| dedup index host sourcetype </span></p>
<p class="MsoNormal">Now we want to essentially do the following to establish the
comparison threshold ( average + ( 2 * std deviation) ). Let’s list that as low
and high threshold respectively. I start with defining
a variable for our std deviation modifier to quickly change it if needed. This could all be combined within the where statement and might even be a hair faster. When you or someone else looked it the query in 6 months though would you be able to read it as well?<br style="mso-special-character: line-break;" />
<!--[endif]--><o:p></o:p></p>
<div style="text-align: left;"><span style="color: #2b00fe;">| eval stdev_mod = 2<br /></span><span style="color: #2b00fe;">| eval avgHostSTThreshold_high = avgHostSTDataVolume + (stdev_mod * stdHostSTDataVolume) <br /></span><span style="color: #2b00fe;">| eval avgSTThreshold_high = avgSTDataVolume + (stdev_mod * stdSTDataVolume) <br /></span><span style="color: #2b00fe;">| eval avgHostSTThreshold_low = avgHostSTDataVolume - (stdev_mod * stdHostSTDataVolume) <br /></span><span style="color: #2b00fe;">| eval avgSTThreshold_low = avgSTDataVolume - (stdev_mod * stdSTDataVolume) </span></div><p class="MsoNormal">Now let’s zoom in on just those outliers and limit our
fields to just what we want to see. I chose not to show the thresholds as they
simply are what they are. What I want to see is what this host’s event counts
are and what are the averages.<o:p></o:p></p><p class="MsoNormal"><span style="color: #2b00fe;">| where count > avgSTThreshold_high OR count > avgHostSTThreshold_high OR count < avgSTThreshold_low OR count < avgHostSTThreshold_low</span><br style="color: #2b00fe;" /><span style="color: #2b00fe;">| fields _time index host sourcetype count avgHostSTDataVolume avgSTDataVolume</span></p>
<p class="MsoNormal">Its likely your averages have quite a few numbers. A simple
round() function can clean it up but let’s use a foreach loop to make the typing
process easier. Its also a great command to leverage. Let’s also rename the
fields since this is what people will see.<o:p></o:p></p><p class="MsoNormal"><span style="color: #2b00fe;">| foreach avg* [ eval <<FIELD>> = round(<<FIELD>>) ]</span><br style="color: #2b00fe;" /><span style="color: #2b00fe;">| rename count as events avgSTDataVolume as "avg events for this sourcetype" avgHostSTDataVolume as "avg events for this host + sourcetype"</span></p><p class="MsoNormal">At this point you will want to schedule the search. Again, based on how this was written you will want to schedule it to run at some point after midnight. If you do cut out the weekend dates the query only needs to run mon-fri with Monday picking up anomalous volumes from Friday. It does mean if there is unusually high/low data coming in over the weekend this query won't catch it. A cron I'd probably start with is <b>17 0 * * 1-5</b>. I'm a fan of using odd numbers for my cron jobs because most people think in terms of even numbers or numbers divisible by 5.</p><p class="MsoNormal">So that's it! Hopefully the query makes sense. Feel free to pass over any feedback. You might need to account for high volume data sources (ie domain controllers). That can be done at the end of the query.</p>Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-17961775534101638532023-01-02T09:44:00.001-05:002023-01-02T09:44:21.334-05:00New Managers: Hiring Process<p>The bug to write has bit again. </p><p>There aren’t a ton of quick resources nor do many orgs place
a lot of emphasis on training for new managers. I’ve done a good bit of candidate
prospecting and hiring over the last year so I’ll write through a bit
through that lens across a few posts. I’m no expert but do have some thoughts
on the subject.</p><p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal">You’re at a point where you must hire someone. What does
that process look like and where do you even start?<o:p></o:p></p>
<p class="MsoNormal">I’d begin by contemplating the following<o:p></o:p></p>
<p class="MsoNormal"></p><ul style="text-align: left;"><li>Who you hire represents a $500k - $1M investment assuming
they will be with you for several years. Make sure you give the process
appropriate time & energy.</li><li>“We hire people based on what they know and fire them for
who they are.” Unknown original source but really like it. Don’t be so focused
on skills that you miss warning signs of cultural fit and work ethic. <span style="mso-spacerun: yes;"> </span></li></ul><o:p></o:p><p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal">After giving those a good think, here are some additional framework-y
things to do some mental gymnastics on before you start. You will inevitably
have to adjust as you go but limit how much of the plane you are building after
it is in the air.<span></span></p><a name='more'></a> <o:p></o:p><p></p>
<p class="MsoNormal"></p><ul style="text-align: left;"><li>Define what your process will be. How many rounds of
interviews will you do, what will each emphasize, how many people and who will
be on each, etc. What are your selection criteria?</li><li>Connect with HR. Every org is different. The HR folks can
clue you in on what’s in place and potential pitfalls. Make sure you have a
good understanding of the entire process through their lens from position
posting to anything they need coming out of interviews (ie notes, scorecards,
etc) to how and how fast offer letters are processed. Who is handling communication
and scheduling – you or them? Sync with them periodically while you are
actively hiring.</li><li>Many HR teams will offer to do phone screens for you. I’ve
always done my own. Even candidates from recruiters. The more
specialized/technical the position is, the more likely you’ll want to do your
own as well would be my guess.</li><li>See if a recruiter is an option. I wouldn’t use more than 2
or 3 though. Walk them through what you are looking for and check in with them
on status of the folks they send your way. If you didn’t move forward with a
candidate let them know why so they can try to adjust their screening process.</li><li>Be calendar time aware, especially if you do several rounds
of interviews. I’m a fan of multiple interviews (more later) but know your
candidate is likely evaluating several opportunities simultaneously. Don’t let
your process drag out forever. Convey this thought to your team if they are
handling any scheduling. </li><li>On that note let your candidates know what your process is. You
might say something like “assuming we move forward at each step, our process
looks like…” I’ve had several candidates say this was the first time they’ve
had that happen. Crazy. Gives you a leg up on your competition. </li><li>Time moves differently for candidates vs hiring managers. Make
sure to keep in contact with them. If you’ve done an interview but have several
more candidate interviews lined up, let the person know it will be a few days/a
week before they will hear from you again. </li><li>Don’t count your chickens before they hatch. What happens if
you’ve selected your top candidate, you’ve cut the others loose, and your
candidate doesn’t accept the job offer? </li><li>Recognize that a candidate doesn’t really turn into an
employee until they’ve been in the job for 2-3 months. It could be they were
interviewing with several orgs and while yours was the offer they accepted
first maybe other offers have come in.</li><li>Don’t be afraid of or discount a candidate if you can’t
pronounce their name. Seriously. Look at them with the same lens as everyone
else. This could warrant its own post of course but…there be dragons. </li></ul><o:p></o:p><p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal">I plan to write at least a segment on position descriptions
and conducting interviews. What’s missing from the items above though?<o:p></o:p></p>Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-116700256324364382021-06-07T10:40:00.002-04:002021-06-07T11:56:47.246-04:00Framework Compliance: Does activity live on a spectrum or an iron triangle?<p>Whenever I see an article title like “<insert framework>: One framework to rule them all” as recently discussed <a href="https://www.csoonline.com/article/3619534/hitrust-explained-one-framework-to-rule-them-all.html">here</a> I’m simultaneously reminded of the following <a href="https://xkcd.com/927/">xkcd cartoon</a>, which touches on the N+1 issues of framework consolidation, and my grandmother saying "you can’t change the direction of a parked car." Relative to achieving framework compliance I’m not sure if those two thoughts live on the same spectrum or make up 2 corners of a compliance related iron triangle. Not sure what the 3rd iron triangle corner would be though.</p>Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-38205544189620616372021-02-02T21:13:00.003-05:002021-02-02T21:19:27.748-05:00Splunking Game Data - Darkfire Heroes part 2<p>In <a href="http://runals.blogspot.com/2021/01/splunking-game-data-darkfire-heroes.html">part of one</a> of this series I went down the path of Splunking game data from a 2 day, single challenge event. In this installment I'm going to dive into a bit of data from an event that encompassed several different challenges. </p><p>In looking back at the dashboard I created, how I was working with some of the data, and the sheer volume of data across all of the challenges - the dashboard itself might not have much value from a game analytic perspective lol. I also realized how much I focused on one challenge - waves. In looking back I think that was largely due to the numbers being smaller. The approaches to displaying the data will work across all of the events so at some level it would be a lot of copy and paste as well. At any rate hopefully folks will take something away from the underlying queries and some of the challenges with trying to display the data/volume of data. TBH this is the more primary focus of this overall effort. </p><p>Data was captured across 4 challenges, 3 player level brackets, and listed scores for the top 100 positions (other than the clan boss fight).</p><p></p><ol style="text-align: left;"><li>Waves - 5 separate groups of mobs attack your heroes</li><li>Pacifism - multi-level, player vs environment (PvP) track where you couldn't bring damage dealers</li><li>No Healers - multi-level, PvE track where you couldn't bring a healer</li><li>Boss - big bad dude that everyone in the clan attacked</li></ol><span><a name='more'></a></span><div>The brackets, from top to bottom, is Expert, Advanced, & Intermediate. So here is the dashboard...</div><div><br /></div><div><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhcb2WMo725c6S4kIBahg6YoCqUnDgmqMp7aaFcQYX_vwVC6Tl7bdLcisPoGta_UkCwa4PDCL3Haip4dLTxkaIb4bHvBkjymQ6BNmGCcxRZJpV0ziqfF6-Lq2ps7NiStoT_5JmumNqTZPg9/s2048/Screen+Shot+2021-01-28+at+7.58.42+PM.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1085" data-original-width="2048" height="213" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhcb2WMo725c6S4kIBahg6YoCqUnDgmqMp7aaFcQYX_vwVC6Tl7bdLcisPoGta_UkCwa4PDCL3Haip4dLTxkaIb4bHvBkjymQ6BNmGCcxRZJpV0ziqfF6-Lq2ps7NiStoT_5JmumNqTZPg9/w400-h213/Screen+Shot+2021-01-28+at+7.58.42+PM.png" width="400" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_8gFLaEK821WjITt2yFGL7IHinN8YVwi1lCInljWflRr7a6JbXb489xLqjE2mQn0bnMLgSLaieurqadtOcM6JMRPyyZNHiR57vyQ6vqXVZLIr-FebEd8oxuQqJEvDOboSUVJXb8qgrr78/s2846/Screen+Shot+2021-01-28+at+8.00.08+PM.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1050" data-original-width="2846" height="148" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_8gFLaEK821WjITt2yFGL7IHinN8YVwi1lCInljWflRr7a6JbXb489xLqjE2mQn0bnMLgSLaieurqadtOcM6JMRPyyZNHiR57vyQ6vqXVZLIr-FebEd8oxuQqJEvDOboSUVJXb8qgrr78/w400-h148/Screen+Shot+2021-01-28+at+8.00.08+PM.png" width="400" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNk3KDpnpkB2JqpCFU0kRTt5z8Tt6k8XjJjZllmuoNfd6pnvVadaKMs6uiBummWwskeeWl5vDtE8_JupIs2Ty0g46hiUUQ7gdl3ZKaWjuDEkaOwRjuiKmCVCJIVbngRlSMvlOeB-soXXU4/s2848/Screen+Shot+2021-01-28+at+8.00.39+PM.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="580" data-original-width="2848" height="81" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNk3KDpnpkB2JqpCFU0kRTt5z8Tt6k8XjJjZllmuoNfd6pnvVadaKMs6uiBummWwskeeWl5vDtE8_JupIs2Ty0g46hiUUQ7gdl3ZKaWjuDEkaOwRjuiKmCVCJIVbngRlSMvlOeB-soXXU4/w400-h81/Screen+Shot+2021-01-28+at+8.00.39+PM.png" width="400" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnWoJvguPWghAAz9uaBRZgj5n_gZ8ImzD1gH4LUA-Yx2Sg7B69c2BKQ6RwhqCnoGWSNwKD3Dyzy3Ga8gtz8gl8pgh59bo0wXwq0H_f62fN_DovczwWDXAvCqpNQFkZUaUpCtTAgbNTlJ1E/s2575/Screen+Shot+2021-01-28+at+8.00.59+PM.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1221" data-original-width="2575" height="190" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnWoJvguPWghAAz9uaBRZgj5n_gZ8ImzD1gH4LUA-Yx2Sg7B69c2BKQ6RwhqCnoGWSNwKD3Dyzy3Ga8gtz8gl8pgh59bo0wXwq0H_f62fN_DovczwWDXAvCqpNQFkZUaUpCtTAgbNTlJ1E/w400-h190/Screen+Shot+2021-01-28+at+8.00.59+PM.png" width="400" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZ7BpRzvf_Hk9wXxkq2N-StFdeDUVSpFG5kfIdGrc76IJJk_6k_2GRLvyDgiLFnVtYKhMhiDOAQK-FOsSaxnxzXnUMFfQ6wp7mBED7Ag9Fz0c12EYqtzWBeJ8WdfITO3_WJAgXfXTW2KWq/s2862/Screen+Shot+2021-01-29+at+9.30.24+PM.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1098" data-original-width="2862" height="154" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZ7BpRzvf_Hk9wXxkq2N-StFdeDUVSpFG5kfIdGrc76IJJk_6k_2GRLvyDgiLFnVtYKhMhiDOAQK-FOsSaxnxzXnUMFfQ6wp7mBED7Ag9Fz0c12EYqtzWBeJ8WdfITO3_WJAgXfXTW2KWq/w400-h154/Screen+Shot+2021-01-29+at+9.30.24+PM.png" width="400" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-ZSo0qZljw8pGKRMHxkTv2n4djAP30_4ZxccOs2cR-oXm0Mi7EiLtnIbpOsJT7r86r3ltLKOzayYEAMLJpJ3fKmA5Jv6EiquETevZOuLnnIO15UsV-mgsWc-1q8Spz3GPZRJzjVRdB94k/s2978/Screen+Shot+2021-01-29+at+9.30.37+PM.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="668" data-original-width="2978" height="90" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-ZSo0qZljw8pGKRMHxkTv2n4djAP30_4ZxccOs2cR-oXm0Mi7EiLtnIbpOsJT7r86r3ltLKOzayYEAMLJpJ3fKmA5Jv6EiquETevZOuLnnIO15UsV-mgsWc-1q8Spz3GPZRJzjVRdB94k/w400-h90/Screen+Shot+2021-01-29+at+9.30.37+PM.png" width="400" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><br /></div><br /><div><br /></div><div>So before I could start making the dashboard I needed to coalesce the data. I wanted to have one master sheet for each challenge but each challenge bracket was in a separate lookup (way to use csv data in Splunk) and each sheet only had 1 column - the score. The merging of this data could easily be done outside of Splunk but the methods here might prove useful to someone. </div><div><br /></div><div>The first attempt was pretty manual - pull the bracket info up, add a column that added their finish position, add a column that indicated what bracket I was adding, pull up the master sheet for that event challenge, and then write out the updated csv. In this case I'm adding the advanced waves bracket to the master waves file. </div><div><br /></div><div><span style="color: #800180;">| inputlookup waves_a_orig.csv </span></div><div><span style="color: #800180;">| streamstats count as finish_position </span></div><div><span style="color: #800180;">| eval bracket = "Intermediate"</span></div><div><span style="color: #800180;">| inputlookup mm1_waves.csv append=t</span></div><div><span style="color: #800180;">| outputlookup mm1_waves.csv</span></div><p></p><p></p><div>The data is already sorted by highest position at the top and then works its way down. Streamstats allows you to do streaming statistical functions that span one or more events. In this case it starts at the first event and performs a running count of how many events there are. This is a great way to enumerate finish position - the first line finished first and is one event - write that out. The second line shows who finished second and the count of events is now 2 - write that out, etc.</div><div><br /></div><div>So while this is effective it isn't exactly quick. What about using the append command? Yep works a treat! Append does what you think. You run a search, run another search, the results of the second search are added to the end of the first search's results. In this case the data had a column named "Score" that I wanted to make lower case.</div><p></p><div><span style="color: #800180;">| inputlookup pacifism_i_orig.csv</span></div><div><div><span style="color: #800180;">| streamstats count as finish_position</span></div><div><span style="color: #800180;">| rename Score as score</span></div><div><span style="color: #800180;">| eval bracket = "Intermediate"</span></div><div><span style="color: #800180;">| append </span></div><div><span style="color: #800180;"> [inputlookup pacifism_a_orig.csv</span></div><div><span style="color: #800180;"> | streamstats count as finish_position </span></div><div><span style="color: #800180;"> | eval bracket = "Advanced"</span></div><div><span style="color: #800180;"> | rename Score as score]</span></div><div><span style="color: #800180;">| append </span></div><div><span style="color: #800180;"> [inputlookup pacifism_e_orig.csv</span></div><div><span style="color: #800180;"> | streamstats count as finish_position </span></div><div><span style="color: #800180;"> | eval bracket = "Expert"</span></div><div><span style="color: #800180;"> | rename Score as score]</span></div><div><span style="color: #800180;">| output lookup mm1_pacifism.csv</span></div></div><div><br /></div><div>So that out of the way let's look at the dashboard panels</div><div><br /></div><div><b>1 - Waves Top 5 Finishers</b></div><div><br /></div><div>Go back and look at this one - it sucks right? This is an example of a query attempt that didn't turn out like I had hoped so I left it in. The dashboard creation process is often iterative /shrug. I wanted to have the top 5 finishers in each bracket for the wave event and show the wave level they finished on in a cascading fashion. It didn't turn out as well as I had hoped. It does show the cascade but you can't really discern much else. Unlike the queries from last time I did use a where statement with the initial pulling up of the csv to only return those records where the person finished in the top 5 positions.</div><div><br /></div><div><div><span style="color: #800180;">| inputlookup mm1_waves.csv where finish_position <=5</span></div><div><span style="color: #800180;">| sort -wave</span></div><div><span style="color: #800180;">| fields - finish_position</span></div></div><div><br /></div><div>Going back after the fact a slightly better way to do this is with the chart command. The following search gets you the result that follows</div><div><br /></div><div><div><span style="color: #800180;">| inputlookup mm1_waves.csv where finish_position <=5</span></div><div><span style="color: #800180;">| chart count by wave bracket</span></div><div><span style="color: #800180;">| sort -wave</span></div></div><div><span style="color: #800180;"><br /></span></div><div><span>In this case the results are showing the top 5 finishers in each bracket then how many people finished at that wave level. In other words in the Expert bracket (green) finishers 3 - 5 all finished on the same level.</span></div><div><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfXcnlWqYcQ8vM9_hd-ZhKXhNGmWowhgOhQZVsDk4-WBdI5iLEkNKakvGEmArMl_qHzCgxG2ns_NLnC7WLt2lG6GZLhAwkPGlm3Q4SBaFF49fQz7uQGfXfSSLbjDuPwl_jcmv4m9xRNNBT/s3010/Screen+Shot+2021-01-29+at+10.07.41+PM.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="564" data-original-width="3010" height="120" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfXcnlWqYcQ8vM9_hd-ZhKXhNGmWowhgOhQZVsDk4-WBdI5iLEkNKakvGEmArMl_qHzCgxG2ns_NLnC7WLt2lG6GZLhAwkPGlm3Q4SBaFF49fQz7uQGfXfSSLbjDuPwl_jcmv4m9xRNNBT/w640-h120/Screen+Shot+2021-01-29+at+10.07.41+PM.png" width="640" /></a></div><br /><div><br /></div><div><br /></div><div><b>2 - Waves Pushed or Not</b></div><div><br /></div><div>So this waves event threw 5 groups mobs at your hero party, one wave at a time, for a certain amount of game energy. You got credit for the number of waves you defeated. A clan mate noted that for most folks if they are "pushing" their team their scores would likely not end in a 0 or 5. If a person's score ended in one of those numbers it was likely the player had simply finished that series of mobs and then didn't return to the game, or that event, for one reason or another. The data does sorta bear out that hypothesis but I'd argue only on the lower end of the brackets (again only the top 100 scores in each bracket were captured). In my last post I mentioned not really liking pie charts - this is a good example of why. It shows some high level information across a lot of data. The eval if statement is a simple way to determine if the wave ended in a 0 or 5 allowing the calculation by that created field. Incidentally doing if and case statements is one of the tremendous value ads within Splunk.</div><div><br /></div><div><div><span style="color: #800180;">| inputlookup mm1_waves.csv</span></div><div><span style="color: #800180;">| eval foo = if(wave LIKE "%0" OR wave LIKE "%5", "Coasted", "Pushed")</span></div><div><span style="color: #800180;">| stats count by foo</span></div></div><div><br /></div><div><b>3 - Pushed or Not - More Pie!</b></div><div><br /></div><div>So while still pie graphs this at least breaks down the data by bracket allowing a bit more insight. In many cases as you develop a dashboard you'd start out at a macro level and get more granular as you go. You could also do something like make this dashboard panel, "hide" it, and if a user clicks on the first graph this panel pops out. Lots of options. This panel also uses the Trellis layout do show all three brackets</div><div><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1fw8TIfcjn1eVwOHxkxpvnsMZLA5YCVIeMzgre4uLNt1NZ9seFjLgO_FJT4lUxSzo4ZNpv6bVaqy28GI9jeS5cB3LqWH5UfVwF9XFvMfWK3GVkZ-SG5hH65nnNl1KVp0A_36LbS-uX7m0/s774/Screen+Shot+2021-01-28+at+9.04.35+PM.png" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" data-original-height="470" data-original-width="774" height="121" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1fw8TIfcjn1eVwOHxkxpvnsMZLA5YCVIeMzgre4uLNt1NZ9seFjLgO_FJT4lUxSzo4ZNpv6bVaqy28GI9jeS5cB3LqWH5UfVwF9XFvMfWK3GVkZ-SG5hH65nnNl1KVp0A_36LbS-uX7m0/w200-h121/Screen+Shot+2021-01-28+at+9.04.35+PM.png" width="200" /></a></div><div><span style="color: #800180;">| inputlookup mm1_waves.csv</span></div><div><span style="color: #800180;">| eval foo = if(wave LIKE "%0" OR wave LIKE "%5", "Coasted", "Pushed")</span></div><div><span style="color: #800180;">| stats count by bracket foo</span></div><div><br /></div><div><br /></div><div><br /></div><div><br /></div><div><br /></div><div><b>4 - Waves Pushed or Not by Bracket</b></div><div><br /></div><div>More waves info! Again part of the goal with this effort is to figure out what queries/panels make sense. Some of these are more viable depending on how you are presenting the data. Is it going to be in Splunk, going to be displayed on a TV, on a PDF, etc. In this case I wanted to dive a bit more into the coasting or pushed across waves folks completed and did anything stand out. So here are some observations (that are maybe harder to discern in the screenshot. Remember these are people in the top 100 finishing positions.</div><div><br /></div><div>The screenshot likely doesn't lend itself well for analysis. As you increase the scope of the data you are looking at though this sort of bar graph setup can be a good way to wrap your head around it. Of course in Splunk as you highlight an item on the legend or the graph itself the rest of data fades out a bit making it easier to tease out some nuances. </div><div><br /></div><div>When using the chart command to essentially convert the data into an xy series you can only do that across 2 data dimensions. So what happens where you want to display a third. I wanted to see pushed or coasted by bracket and show what levels folks landed on. The trick is to use an eval to combine the two fields. </div><div><br /></div><div><div><span style="color: #800180;">| inputlookup mm1_waves.csv</span></div><div><span style="color: #800180;">| eval foo = if(wave LIKE "%0" OR wave LIKE "%5", "Coasted", "Pushed")</span></div><div><span style="color: #800180;">| eval bar = bracket.": ". foo</span></div><div><span style="color: #800180;">| chart count by wave bar</span></div></div><div><br /></div><div><b>5 - Wave: Finish Deltas</b></div><div><br /></div><div>One of the things I was curious about was how much did the top finishing positions actually finish by. This calls for a more complex use of streamstats</div><div><br /></div><div><div><span style="color: #800180;">| inputlookup mm1_waves.csv where finish_position <= 5</span></div><div><span style="color: #800180;">| sort bracket finish_position</span></div><div><span style="color: #800180;">| streamstats window=1 current=false max(wave) as previous by bracket</span></div><div><span style="color: #800180;">| eval foo = previous - wave</span></div><div><span style="color: #800180;">| eval foo = if(isnull(foo), 0, foo)</span></div><div><span style="color: #800180;">| chart list(foo) by finish_position bracket</span></div><div><span style="color: #800180;">| table finish_position Intermediate Advanced Expert</span></div></div><div><br /></div><div>So let's start with the top 5 positions. Ultimately what we want to do is compare the wave finish level of any given finisher to finish level of the person who finished just before them. To do that we first need to sort by bracket and then by finish level. Streamstats needs to be structured such that we want to use just one event (window=1) and NOT use the current event (current=false). We will put that data into a field called "previous" allowing us to do the math (eval statement). Then since we only are getting the top 5 the 5th position doesn't have anything to compare against so let's just put a 0 in that slot.</div><div><br /></div><div>Two issues with this. The first is the resulting data doesn't "read" well - ie the second place finisher in the intermediate bracket lost by/was behind by 13 levels. The other thing is what about pulling in the data from 1 more finish position than you are going to display which allows you to calculate what that last displayed set actually won by. So...</div><div><br /></div><div><b>6 - Waves: Finish Deltas 2</b></div><div><br /></div><div><div><span style="color: #800180;">| inputlookup mm1_waves.csv where finish_position <= 6</span></div><div><span style="color: #800180;">| sort bracket -finish_position</span></div><div><span style="color: #800180;">| streamstats window=1 current=false max(wave) as previous by bracket</span></div><div><span style="color: #800180;">| eval foo = abs(previous - wave)</span></div><div><span style="color: #800180;">| search finish_position <= 5</span></div><div><span style="color: #800180;">| chart list(foo) by finish_position bracket</span></div><div><span style="color: #800180;">| table finish_position Intermediate Advanced Expert</span></div></div><div><br /></div><div>There are 3 changes. The first is to pull out the top 6 finish positions; then display the top 5. The second is sort in reverse order. You are still comparing finishing levels but by sorting it this way vs the way in the 5th panel the data can be displayed as "the 1st place finisher in Intermediate won by 13 levels". Now because I didn't change the subtraction though the number would be negative. Simple enough to do "waves - previous" but might as well show something else. Get the absolute value of the change; removes that negative. To help understand what the data looks like with the streamstats command output looks take a look at the following. This uses the query up until it gets to the eval foo line.</div><div><br /></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlqer6s5K9kedu7b-O5gb37nyEIf4OykNv4mjjMZM1_bF4LFIWIThts5cHBjCICia3DP15VoJPkICVVY_QyIj2oRcBiaLgY-O_OPK1UjM4nZhIJME0nXagehJ5nczDMd3bqmWfC4faGNxp/s1924/Screen+Shot+2021-02-02+at+8.19.09+PM.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="444" data-original-width="1924" height="149" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlqer6s5K9kedu7b-O5gb37nyEIf4OykNv4mjjMZM1_bF4LFIWIThts5cHBjCICia3DP15VoJPkICVVY_QyIj2oRcBiaLgY-O_OPK1UjM4nZhIJME0nXagehJ5nczDMd3bqmWfC4faGNxp/w640-h149/Screen+Shot+2021-02-02+at+8.19.09+PM.png" width="640" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">Which for reference ultimately is displayed as</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjhvdW7wtYkeW75IRFrhKBcxWSUdrJeb2dB76ZOWLn_lTVMTVA5wS9CgAz9kFt14KESpsId9Cgbf298tCGIkNdcXY5ipLZm55uhezI7x_KHjEwx6oj3BsogHvag5bf5DkMKWxev2FR86vmj/s1296/Screen+Shot+2021-02-02+at+9.18.43+PM.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="450" data-original-width="1296" height="222" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjhvdW7wtYkeW75IRFrhKBcxWSUdrJeb2dB76ZOWLn_lTVMTVA5wS9CgAz9kFt14KESpsId9Cgbf298tCGIkNdcXY5ipLZm55uhezI7x_KHjEwx6oj3BsogHvag5bf5DkMKWxev2FR86vmj/w640-h222/Screen+Shot+2021-02-02+at+9.18.43+PM.png" width="640" /></a></div><br /><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">For the next 3 panels I wanted to show the curve of relative placement across the rest of the individual challenges using different visualizations. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b>7 - Top 10 Wave Finishes</b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><div class="separator" style="clear: both;"><span style="color: #800180;">| inputlookup mm1_waves.csv where finish_position <= 15</span></div><div class="separator" style="clear: both;"><span style="color: #800180;">| chart max(wave) by finish_position bracket</span></div><div class="separator" style="clear: both;"><span style="color: #800180;">| table finish_position Expert Advanced Intermediate</span></div><div class="separator" style="clear: both;"><br /></div><div class="separator" style="clear: both;"><br /></div><div class="separator" style="clear: both;"><b>8 - No Healers Top 15 by Bracket</b></div><div class="separator" style="clear: both;"><br /></div><div class="separator" style="clear: both;"><div class="separator" style="clear: both;"><span style="color: #800180;">| inputlookup mm1_no_healers.csv where finish_position <= 15</span></div><div class="separator" style="clear: both;"><span style="color: #800180;">| chart max(score) by finish_position bracket</span></div><div class="separator" style="clear: both;"><span style="color: #800180;">| table finish_position Expert Advanced Intermediate</span></div></div><div class="separator" style="clear: both;"><br /></div><div class="separator" style="clear: both;"><br /></div><div class="separator" style="clear: both;"><b>9 - Pacifism - Top 5</b></div></div><br /><div><div><span style="color: #800180;">| inputlookup mm1_pacifism.csv where finish_position <= 5</span></div><div><span style="color: #800180;">| chart max(score) by finish_position bracket</span></div><div><span style="color: #800180;">| table finish_position Expert Advanced Intermediate</span></div></div><div><br /></div><div><b>10 - Waves: Clan Finishes</b></div><div><br /></div><div>So yes....more waves lol. In this case though individual waves completed added to your clan's total. What I like about this, like the last blog installment, is showing overall clan scores, how many members are in the clan, and how many people contributed. Once again - if folks are in clans outside the top 7 or 8 they might be well served by thinning the ranks...or doing a merge of active players. The query is straight forward since the of all the data in this csv I don't really want to display the finish position.</div><div><br /></div><div><div><span style="color: #800180;">| inputlookup mm1_waves_clan.csv</span></div><div><span style="color: #800180;">| fields - finish_position</span></div></div><div><br /></div><div><b>11 - Waves: Clans by Member/Contributor</b></div><div><br /></div><div>One of the things to look at across this data is take a look at the average number of waves a clan member contributed. And to do something a bit different I threw in some color based on the scale of numbers. If you look closely the color can help show SpawnsofDiablo, 3rd place finisher, had a slightly higher average wave finish per player but had 2 fewer members than Assassins who finished 2nd. That likely isn't THE reason for their respective clan finish positions but it does contribute to the story. Again the use of color can help pull some of those subtleties out here and in other datasets. </div><div><br /></div><div><div><span style="color: #800180;">| inputlookup mm1_waves_clan.csv</span></div><div><span style="color: #800180;">| eval avgScore_Contributor = Score/Contributors</span></div><div><span style="color: #800180;">| eval avgScore_Member = Score/Members</span></div><div><span style="color: #800180;">| foreach avg* </span></div><div><span style="color: #800180;"> [eval <<FIELD>> = round(<<FIELD>>) ]</span></div><div><span style="color: #800180;">| fields Clan Members Contributors avg*</span></div></div><div><br /></div><div>Since I'm displaying numbers vs showing them on a graph I want to round the averages to the nearest integer. I can do that with 2 evals but let's try something more fun - a looping eval function. I'm saying for any field that starts with "avg", in this case avgScore_Contributor and avgScore_Member, round any numbers in those fields. </div><div><br /></div><div><b>12 - Clan Boss Scores</b></div><div><br /></div><div>The last event type is one where everyone in the clan beats up on a couple big boss mobs. Since I have that data in one file this is just a matter of displaying the scores. I also wanted to display members vs contributors in a different fashion than on the waves event. What is very interesting is the step down nature of the clan results: 1 to 2, 4 to 5, 5 to 6, 15 to 16, and even 21 to 22. All of this data is manually collected which is a shame - it would be interesting to dive into all of the pieces that contribute to why those drops exist.</div><div><br /></div><div><div><span style="color: #800180;">| inputlookup mm1_clan_boss.csv</span></div><div><span style="color: #800180;">| table finish_position Score</span></div></div><div><br /></div><div><b>13 - Clan Boss Participation</b></div><div><br /></div><div>Interesting to me is this is probably the first time I've used an area chart where I have the data elements overlap vs stack. I often see overlapping area charts for things like memory or cpu across multiple systems which has, IMO, somewhat limited usability. At any rate in this case it helps showcase the slope of clan members participating in this event. Unfortunately the data doesn't tell you how many times someone fought the boss; just their aggregate contribution. There is value in looking at this panel by itself but also looking up and down comparing activity vs total clan scores.</div><div><br /></div><div><div><span style="color: #800180;">| inputlookup mm1_clan_boss.csv</span></div><div><span style="color: #800180;">| table Clan Contributors Members</span></div></div><div><br /></div><div><b>14 - Overall Clan Performance</b></div><div><br /></div><div>We've FINALLY made it to the end. If you think this was a long read you'd be surprised how long it took me to write lol. </div><div><br /></div><div>So the first thing to mention is you will want to install the Parallel Coordinates app from Splunkbase to get this visualization. I'm pulling in the top 20 clan finish positions (because those are the only clan names I wrote down) and then limiting the results to just those where the clan placed in the top 20 for both clan events. 18 clans fit that description. The lines in the screenshot are light colored and fairly hard to see. This visualization can be great though to get your arms across larger, multi-dimension data sets to see where things converge or diverge. There is also the ability to select a range on one or more Y axis which highlights those lines within those ranges. </div><div><br /></div><div><div><span style="color: #800180;">| inputlookup mm1_waves_clan.csv</span></div><div><span style="color: #800180;">| head 20</span></div><div><span style="color: #800180;">| rename Contributors as Waves_Contributors Score as Waves_Score finish_position as Waves_Finish</span></div><div><span style="color: #800180;">| append </span></div><div><span style="color: #800180;"> [| inputlookup mm1_clan_boss.csv </span></div><div><span style="color: #800180;"> | head 20</span></div><div><span style="color: #800180;"> | rename Contributors as Boss_Contributors Score as Boss_Score finish_position as Boss_Finish]</span></div><div><span style="color: #800180;">| stats max(Members) as Members list(Waves_*) as Waves_* list(Boss_*) as Boss_* by Clan</span></div><div><span style="color: #800180;">| table Clan Members Waves_Finish Waves_Contributors Boss_Finish Boss_Contributors</span></div><div><span style="color: #800180;">| sort -Clan</span></div><div><span style="color: #800180;">| search Boss_Finish=* Waves_Finish=*</span></div></div><div><span style="color: #800180;"><br /></span></div><div>Pull in the first set of data, limit the results to the top 20, and then rename the fields to distinguish one event from the other. Then append the second clan event's data; same methodology. So now we have an issue - data for any given clan is spread over two rows<br /><br /></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEinak5eP36Xr-QDt7hykUaZR9mAPORiATdFD-4eI9qFCzPoGdIfGao9bRMviVRd1JWYORTq5Y2B5cpyCVRA5bzDya2yRcAqGGyVgYFyhrm4Cc0-2jVmZmYTNqJujH8SHq5-T2PjTZfmwchg/s2600/Screen+Shot+2021-02-02+at+9.01.17+PM.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="212" data-original-width="2600" height="52" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEinak5eP36Xr-QDt7hykUaZR9mAPORiATdFD-4eI9qFCzPoGdIfGao9bRMviVRd1JWYORTq5Y2B5cpyCVRA5bzDya2yRcAqGGyVgYFyhrm4Cc0-2jVmZmYTNqJujH8SHq5-T2PjTZfmwchg/w640-h52/Screen+Shot+2021-02-02+at+9.01.17+PM.png" width="640" /></a></div><div><br /></div>One way to deal with that is to do a stats command where you get the values for any given field and split by the clan name. A little trick you can do when you have fields that have the same stem or end is to use wildcards like I've done. The last real thing I'm doing is I want to display just those clans who finished in the top 20 across both events; thus the finish search command.<div><br /></div><div>So there you go! Hopefully this gives you a few examples of searches against perhaps some non standard data. Of course with Splunk data is simply data and all of it is queryable. </div><div><br /></div><div>As I've alluded to data collection for this was manual. Thanks to LoucoReiPirata and jopan for their help!<br /><div><br /></div></div>Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-85999240999032470912021-01-15T15:25:00.004-05:002023-11-03T15:46:51.777-04:00Splunking Game Data - Darkfire Heroes<p>(<a href="http://runals.blogspot.com/2021/02/splunking-game-data-darkfire-heroes.html">Part 2 Link</a>)</p><p>So there is somewhat of an eclectic mix of drivers going into this post. As I talk with individual Splunk users, Splunk administrative teams, and larger teams that have access to Splunk (security, operations, etc) I sometimes come across a subset of folks who have a tough time trying to figure out how to take advantage of the data they have access to. In some cases it is because they lack imagination, vision, or strategy relative to what they are trying to accomplish. Sometimes it is being so heads down in the daily grind they have trouble 'looking up' so to speak and collecting their thoughts. More often than not though they are wearing multiple hats and could use a hand getting over the Splunk language learning curve. This post is designed to help a bit - some Splunk Processing Language (SPL) exposure mixed with a bit of dialogue on why I made the dashboard/dashboard panels the way I did.</p><p>To start with I need data. Turns out I've started playing a mobile game called Darkfire Heroes. It isn't quite in a beta state but isn't available globally quite yet. The other day, Dec 8 & 9 to be exact, they had a 2 day Player vs Player (PvP) contest. Individual match wins were tracked as well as aggregate win total if you belonged to a group within the game; a clan. As a total side note it is interesting to see people's gaming pedigree based on descriptions they use. Are some of the bad guys/monsters you fight creeps, mobs, trash, etc and are you a part of a clan, guild, or alliance? Outside of this mini event there is a clan rewards chest that also gives varying level of rewards based on aggregate PvP wins over a week. PvP matches won during this 2 day event will count towards that reward chest. </p><p><span></span></p><a name='more'></a>There are any number of business related questions the game company might want to ask of game data that could range from who to give individual rewards to all the way to game performance: how many players participated, who are the top winners, did the event cause an increase in game play, did the system respond well to the increased load or were there issues, was there increased spending via in game purchases during this time and if so what items, etc etc. <p></p><p>Since I don't have access to the backend system I had to manually collect data. The first bit of collected data is for the top 150 clans I captured aggregate clan results and the number of players in that clan; clans can have a max of 50 members. The second bit was for clans currently in spots 1, 2, 3, 10, 20, 30, 40, 50, & 60th place I captured individual contributions. I should mention that since the event data would be wiped after it ended and I wanted to get to sleep at a sane time, when I collected the data there was still about 4hrs left to go. So while the clan placement and individual contribution data is generally accurate (as in directionally correct) it isn't 100% precise. To be fair this data isn't very complex and based on volume you could do lots of this analysis in Excel or something else. Where Splunk really shines is if we had access to the hundreds of thousands of data points that would be available to the game developers in the same way that Splunk shines for InfoSec, IT Ops, and BI teams when the data volume might range from thousands to billions of events or transactions per day. </p><p>So with that out of the way here are the visualizations I created. Mentally I'm somewhat putting myself in the shoes of the game design team and trying to get an overview of the event. Below the dashboard screenshots I will walk through each of the panels and the query used. In some cases I didn't use a more expedient query method to give a bit more range in my examples. Ultimately I will post the data in case you want to play with it!</p><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5z18Z_zr-unzBzLiD87A_qThYqKV9lpmPEbx0bReba7sAoDtw64pAeSyhSZL4p6FZmMubnWG-JBtRilYDxl2tnqcj8bIgh-AW8_9JIn8g0L4PCp2WMGwP5tWHS2C3TSEijZGqqzp2pjsE/s2048/pvp1-5.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1071" data-original-width="2048" height="209" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5z18Z_zr-unzBzLiD87A_qThYqKV9lpmPEbx0bReba7sAoDtw64pAeSyhSZL4p6FZmMubnWG-JBtRilYDxl2tnqcj8bIgh-AW8_9JIn8g0L4PCp2WMGwP5tWHS2C3TSEijZGqqzp2pjsE/w400-h209/pvp1-5.png" width="400" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEigo5YzBbxcE7X0GElSvK8WsEgpx6thi7HUbypagImoRW710E52g-oI7ziafdjAUSCrxjOoJqmHz9Jopnghbx01mz3SoMkQLzhueWuuM2RQJdE5qHAUtt0DSUlejWTfPUJDFj3zr4Fi6uD8/s2368/pvp6-8.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1172" data-original-width="2368" height="198" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEigo5YzBbxcE7X0GElSvK8WsEgpx6thi7HUbypagImoRW710E52g-oI7ziafdjAUSCrxjOoJqmHz9Jopnghbx01mz3SoMkQLzhueWuuM2RQJdE5qHAUtt0DSUlejWTfPUJDFj3zr4Fi6uD8/w400-h198/pvp6-8.png" width="400" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2ZWMYYRFSFMhyphenhyphenIXzNG6Kk3LX0x-G95doAcLmOmSubQe4yISnAZpC-ZNkggqdnG7x_GTyrIsPrtJXv5xqHXmGBW_5YduAHUnphhopSiTmMgoaduuG1_GrRyi3AMzxdd8se6Xe7W50uSiX8/s2048/pvp9-10.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1305" data-original-width="2048" height="255" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2ZWMYYRFSFMhyphenhyphenIXzNG6Kk3LX0x-G95doAcLmOmSubQe4yISnAZpC-ZNkggqdnG7x_GTyrIsPrtJXv5xqHXmGBW_5YduAHUnphhopSiTmMgoaduuG1_GrRyi3AMzxdd8se6Xe7W50uSiX8/w400-h255/pvp9-10.png" width="400" /></a></div><br /><p>The first three panels are about giving high level summary snapshots of activity</p><p><b>1 - Total Clan Wins</b></p><p>While I only captured aggregate numbers for the top 150 clans I did note how many clans participated. There are probably individuals not in clans who had wins but that data is beyond the scope of what I have access to or care about. I used the makeresults command to generate 1 event, created a field to hold the number of clans who participated, and since Splunk is a time based engine and makeresults creates an event with a timestamp I removed that field. Obviously this is the single value visualization</p><div style="text-align: left;"><span style="color: #2b00fe;">| makeresults <br />| eval foo = 236 <br />| fields - _time</span></div><p><b>2 - Total Matches Played</b></p><p>A good high level metric is how many PvP matches were played. The only real data I have here though is the number of wins by the top 150 clans. This starts to be a bit of a f<a href="https://en.wikipedia.org/wiki/Fermi_problem">ermi problem</a> in that a player could face a human or a bot so it isn't a zero sum game where one person has to lose. Some players are better than others and might only win a percentage of their games. To make things simple I'm just going to assume a 50% win rate when you average across the player base. The data I've captured was in csv format so I've uploaded that into Splunk as a lookup. So I'm going to pull that csv up, add up the wins, and then multiply that number by 2. </p><div style="text-align: left;"><span style="color: #2b00fe;">| inputlookup clan_leaderboard.csv <br />| stats sum(wins) as wins<br />| eval games = wins * 2</span></div><p><b>3 - Clan Chests Filled</b></p><p>If we go back to that concept of filling the weekly clan reward chest you might wonder how many clans had enough wins to fill that up over the span of the event? This is more of a fun little metric but also points toward participation at a broader scale. We will explore the clan chest filling bit in a bit more granularity in a later panel. To max out the clan chest you need like 1,186 wins. Because I've captured the data 4 hrs before the event ended I want to give folks the benefit of the doubt. I bring in the leaderboard csv, filter results to clans who have more than 1k wins, and count the number of results. </p><div style="text-align: left;"><span style="color: #2b00fe;">| inputlookup clan_leaderboard.csv <br />| where wins > 1000 <br />| stats count</span></div><p><b>4 - Who Likes Pie?</b></p><p>The next question you'd likely want to know is the leaderboard - which clans finished 1, 2, 3 etc. There are a lot of ways to display that data. In this case I did a pie graph because some people like the visual element. TBH I'm not a big pie graph fan - there are generally too many data dimensions not captured in it. Anyway, that's why it has this goofy title. The query is simple enough. Bring in the leaderboard, get rid of fields that are not needed (alternatively I could have explicitly kept the fields I wanted to keep), and just to cover my bases sort the results. Not in this case but often sorting results in Splunk that are being displayed in a pie graph make the visualization a bit more organized. </p><div style="text-align: left;"><span style="color: #2b00fe;">| inputlookup clan_leaderboard.csv <br />| fields - members finish_position </span></div><div style="text-align: left;"><span style="color: #2b00fe;">| sort -wins</span></div><p><b>5 - Clan Wins and Percent of Total Battles</b></p><p>So when you mouse over pie graphs in Splunk the UI will automagically show you percentages to the total for that wedge. In this case I wanted to display that in a statistical view. There are a couple different ways to do this. In this case I wanted to highlight the eventstats command. When you use a stats command it is 'destructive' in that the only fields that will persist are the ones you use in that command. Alternatively you can use an eval command to do mathematical things but they are constrained to each row. In this case I need to calculate the total number of wins across all rows and compare each clan's (each row's) wins against the total. To that end eventstats is like stats and eval had a baby. For my query I'm going to bring in the leaderboard once again, add up the total number of wins and create a new field called "totalWins", get the percentage of each clan's wins to totalWins and then just display the fields I want</p><div style="text-align: left;"><span style="color: #2b00fe;">| inputlookup clan_leaderboard.csv <br />| eventstats sum(wins) as totalWins <br />| eval percOfTotalWins = round((wins/totalWins)*100) <br />| table clan wins percOfTotalWins</span></div><p>6 - Contributors Relative to Wins</p><p>This was one of my more favorite panels and made me wish I had more data! I wanted to get a feel for how active folks were over the event and what participation actually looked like. I also find it curious that most clans are full of people even if they are inactive (why clans don't kick inactive people is beyond me). Now I only captured individual contributions from 9 clans; places 1, 2, 3, 10, 20, 30, 40, 50, 60. Like a goof though I didn't actually write down the clan name that was in 60th place which is why there are only 8 dots on the graph. This query uses a join (green) to bring both datasets together. Generally speaking you don't need to do joins with data in Splunk but if you need to use them the tool is there. So the green bits are getting the number of people in each of the tracked clans (9) who actually contributed. The join type is left because otherwise the only data displayed would be that where the linking field is a match (clan in this case). Then it is just a simple matter of displaying the fields in the order I want. </p><div style="text-align: left;"><span style="color: #2b00fe;">| inputlookup clan_leaderboard.csv <br />| join type=left clan<br /><span style="background-color: #04ff00;"> [| inputlookup clan_efforts.csv <br /> | search wins > 0 <br /> | stats count as contributors by clan</span>]<br />| table clan contributors wins members</span></div><p>I'm also using 2 Y axis on this visualization by leveraging a chart overlay. The contributors and members fields leverage the Y axis on the right side of the graph.</p><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDUMkupCTQ1fVYl2vq8slsG3mmC-fFDtDfiC4oF67uWaRq1RDMUI87p-JOWCB-sSiUeQp_QzvB783pHPonEGwMXPyeg5UjxzjlzYtJsUOUKC3kJ3_D16mJ99UjyNjUYDv8SlPaV6DzCtAN/s1064/chart_overlay.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="594" data-original-width="1064" height="224" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDUMkupCTQ1fVYl2vq8slsG3mmC-fFDtDfiC4oF67uWaRq1RDMUI87p-JOWCB-sSiUeQp_QzvB783pHPonEGwMXPyeg5UjxzjlzYtJsUOUKC3kJ3_D16mJ99UjyNjUYDv8SlPaV6DzCtAN/w400-h224/chart_overlay.png" width="400" /></a></div><br /><p><br /></p><p><b>7 - Clan Chest Filled / 8 - Chan Chest Filled</b></p><p>The queries behind these two panels are the same. What I wanted to show here is a couple different visualization options. Some people are more drawn to one vs another. Sometimes it is worthwhile to use different visualizations simply from a visual interest perspective. Anyway, while 6 clans would have totally maxed out their weekly reward chest we know that any wins would have contributed in some measure. We could figure out what that percentage is for each of the 150 but how do you display that in some meaningful way without taking up a ton of screen real estate? One answer is to figure out that percentage and then lump those results into various size buckets. This is an easy process to do in Splunk of course. I'm going to go with buckets of 10% sizes so for any given clan the data would say 0-10, 40-50, 80-90 as applicable. Unfortunately because of the data there is also going to be a bucket with 100-110 that we need to take care of. The query starts out simple enough - bring up the data, create a field with the number of wins to max out the chest (I used the actual number here for some reason), line 3 creates a new field that gets the fill percentage. At line 4 I introduce an IF statement because the top clans have several folks who played a bunch of games. If the percentage field is over 100 then just make that value 100, otherwise just round the percentage field to clean it up a bit. That isn't really needed but shows you how to include different functions. At this point we are going to 'bucketize' that perc_field field with buckets that are 10 points wide. Now it is simply a matter of counting the number of clans by each of the buckets with the stats command followed by fixing the 100-110 issue in eval that follows it.</p><div style="text-align: left;"><span style="color: #2b00fe;">| inputlookup clan_leaderboard.csv <br />| eval full_chest = 1186 <br />| eval perc_filled = (wins/full_chest)*100 <br />| eval perc_filled = if(perc_filled>=100, 100, round(perc_filled) ) <br />| bin perc_filled span=10 </span></div><div style="text-align: left;"><span style="color: #2b00fe;">| stats count as clans by perc_filled <br />| eval perc_filled = if(perc_filled LIKE "100%", 100, perc_filled) <br />| sort perc_filled</span></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><b>9 - Member Participation</b></div><div style="text-align: left;"><br /></div><div style="text-align: left;">This panel starts to display some of the more granular data from panel 6 though it is constrained to the 9 clans I captured individual contributions for. What I'd like to start to tease out of the data is how quickly does participation drop off relative to clan membership. To that end I want to display clan name, the order they finished (at least position they were in 4hrs before the finish), the clan win count, number of participating members, and finally the average number of wins per member. For this I start with the csv that has the granular info and then get the math out of the way; the eval statement that follows cleans up that average number. Now we want to add the context from the overall clan leaderboard results what position these clans were in. That's a simple lookup and comparison off the 'clan' field. The final eval is because I didn't capture the clan names past the 50th position. I know Valhalla was the 60th at the time of data capture so I'm manually inserting that in the blank field for the finish_position column.</div><div style="text-align: left;"><br /></div><div style="text-align: left;"><span style="color: #2b00fe;">| inputlookup clan_efforts.csv </span></div><div style="text-align: left;"><span style="color: #2b00fe;">| search wins > 0 </span></div><div style="text-align: left;"><span style="color: #2b00fe;">| stats sum(wins) as clan_wins dc(clan_member) as contributing_members avg(wins) as avgMemberWins by clan </span></div><div style="text-align: left;"><span style="color: #2b00fe;">| eval avgMemberWins = round(avgMemberWins) <br />| sort -clan_wins</span></div><div style="text-align: left;"><span style="color: #2b00fe;">| lookup clan_leaderboard.csv clan </span></div><div style="text-align: left;"><span style="color: #2b00fe;">| table clan finish_position clan_wins contributing_members avgMemberWins </span></div><div style="text-align: left;"><span style="color: #2b00fe;">| eval finish_position = if(isnull(finish_position), 60, finish_position)</span></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><b>10 - Top 10 Hitters</b></div><div style="text-align: left;"><br /></div><div style="text-align: left;">Pretty standard "who got the most wins regardless of clan" visualization. For this I need to bring in the individual efforts sheet, sort it by wins in descending order, grab the top 10 lines. That by itself would be your top 10 folks and what clan they were in. Since I have the data I figured might as well show clan representation in that top 10 so used eventstats again. I've often used this sort of approach as an incident responder to display multiple dimensions of data in one spot. Imagine a report for failed authentication that has username, source IP, and failed auth counts. Using eventstats would let you also display how many unique users have tried and failed to log in from that IP and how many unique IPs that username tried to log in from. The challenge I've found is labeling those fields so that folks understand what those 2 additional columns mean.</div><div style="text-align: left;"><br /></div><div style="text-align: left;"><div><span style="color: #2b00fe;">| inputlookup clan_efforts.csv </span></div><div><span style="color: #2b00fe;">| sort -wins </span></div><div><span style="color: #2b00fe;">| head 10 </span></div><div><span style="color: #2b00fe;">| eventstats dc(clan_member) as "clan participants in top 10" by clan</span></div><div><span style="color: #2b00fe;">| table clan clan_member "clan participants in top 10" wins</span></div><div><span style="color: #2b00fe;">| rename clan_member as player</span></div><div><br /></div><div>So hopefully that was useful or at least somewhat interesting to folks. I'll now go ahead and paste the raw data in case you want to play around.</div><div><br /></div><div>Individual Clan Efforts</div><div><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">clan,"clan_member",wins</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_1",504</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_2",500</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_3",349</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_4",335</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_5",222</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_6",209</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_7",177</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_8",152</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_9",137</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_10",129</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_11",124</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_12",118</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_13",116</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_14",102</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_15",85</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_16",78</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_17",75</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_18",74</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_19",67</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_20",59</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_21",56</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_22",56</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_23",56</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_24",52</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_25",51</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_26",51</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_27",49</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_28",43</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_29",41</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_30",39</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_31",34</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_32",31</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_33",28</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_34",24</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_35",24</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_36",18</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_37",17</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_38",16</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_39",14</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_40",9</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_41",8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_42",5</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_43",5</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_44",3</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,"Diablo2_45",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_1",488</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_2",307</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_3",272</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_4",266</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_5",199</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_6",171</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_7",166</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_8",161</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_9",151</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_10",138</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_11",130</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_12",120</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_13",110</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_14",103</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_15",98</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_16",80</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_17",78</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_18",72</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_19",62</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_20",53</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_21",51</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_22",49</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_23",49</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_24",48</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_25",44</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_26",38</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_27",32</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_28",32</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_29",27</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_30",27</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_31",26</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_32",24</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_33",23</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_34",23</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_35",22</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_36",21</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_37",17</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_38",13</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_39",13</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_40",11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_41",11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_42",11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_43",9</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_44",9</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_45",8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_46",5</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_47",3</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_48",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,"SpawnsofDiablo_49",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_1",560</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_2",399</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_3",190</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_4",147</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_5",131</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_6",102</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_7",89</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_8",77</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_9",53</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_10",52</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_11",49</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_12",48</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_13",43</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_14",40</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_15",38</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_16",37</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_17",37</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_18",30</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_19",27</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_20",22</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_21",19</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_22",18</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_23",17</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_24",17</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_25",16</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_26",16</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_27",16</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_28",15</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_29",15</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_30",14</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_31",14</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_32",14</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_33",12</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_34",11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_35",9</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_36",9</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_37",9</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_38",9</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_39",8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_40",7</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_41",7</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_42",7</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_43",7</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_44",7</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_45",4</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_46",4</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_47",4</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_48",3</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_49",3</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,"LegendsOnly_50",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_1",167</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_2",66</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_3",58</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_4",50</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_5",33</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_6",29</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_7",27</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_8",24</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_9",21</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_10",21</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_11",19</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_12",16</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_13",15</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_14",13</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_15",12</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_16",12</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_17",11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_18",11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_19",11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_20",10</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_21",10</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_22",8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_23",7</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_24",7</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_25",6</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_26",6</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_27",6</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_28",6</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_29",5</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_30",5</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_31",5</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_32",4</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_33",3</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_34",3</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_35",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_36",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_37",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_38",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_39",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_40",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_41",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_42",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_43",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_44",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_45",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_46",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_47",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_48",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_49",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,"Worldwarriors_50",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_1",23</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_2",21</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_3",21</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_4",20</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_5",19</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_6",17</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_7",16</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_8",12</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_9",11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_10",10</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_11",10</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_12",9</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_13",9</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_14",8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_15",8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_16",7</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_17",7</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_18",7</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_19",7</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_20",7</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_21",6</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_22",5</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_23",5</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_24",5</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_25",4</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_26",4</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_27",3</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_28",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_29",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_30",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_31",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_32",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_33",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_34",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_35",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_36",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_37",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_38",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_39",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_40",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_41",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_42",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_43",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_44",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_45",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_46",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_47",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_48",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_49",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,"ColoradoCasual_50",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_1",34</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_2",30</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_3",25</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_4",14</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_5",13</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_6",11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_7",11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_8",8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_9",7</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_10",5</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_11",4</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_12",3</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_13",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_14",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_15",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_16",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_17",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_18",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_19",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_20",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_21",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_22",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_23",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_24",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_25",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_26",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_27",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_28",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_29",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_30",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_31",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_32",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_33",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_34",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_35",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_36",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_37",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_38",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_39",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_40",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_41",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_42",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_43",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_44",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_45",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_46",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_47",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_48",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_49",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,"Armyofall_50",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_1",17</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_2",16</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_3",14</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_4",11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_5",10</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_6",7</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_7",7</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_8",3</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_9",3</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_10",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_11",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_12",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_13",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_14",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_15",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_16",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_17",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_18",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_19",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_20",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_21",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_22",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_23",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_24",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_25",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_26",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_27",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_28",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_29",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_30",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_31",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_32",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_33",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_34",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_35",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_36",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_37",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_38",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_39",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_40",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_41",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_42",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_43",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_44",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_45",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_46",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_47",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_48",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_49",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,"HordSmashers_50",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_1",14</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_2",14</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_3",10</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_4",8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_5",7</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_6",5</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_7",4</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_8",3</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_9",3</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_10",3</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_11",3</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_12",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_13",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_14",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_15",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_16",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_17",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_18",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_19",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_20",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_21",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_22",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_23",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_24",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_25",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_26",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_27",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_28",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_29",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_30",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_31",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_32",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_33",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_34",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_35",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_36",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_37",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_38",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_39",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_40",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_41",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_42",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_43",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_44",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_45",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_46",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_47",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_48",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_49",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,"SinCityKnights_50",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_1",10</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_2",9</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_3",9</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_4",8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_5",6</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_6",4</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_7",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_8",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_9",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_10",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_11",2</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_12",1</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_13",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_14",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_15",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_16",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_17",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_18",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_19",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_20",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_21",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_22",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_23",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_24",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_25",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_26",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_27",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_28",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_29",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_30",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_31",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_32",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_33",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_34",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_35",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_36",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_37",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_38",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_39",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_40",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_41",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_42",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_43",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_44",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_45",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_46",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_47",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_48",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_49",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Valhalla,"Valhalla_50",0</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><br /></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;">////////////////////////////////</p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><br /></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;">Clan Leaderboards</p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><br /></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">clan,"finish_position",members,wins</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Diablo2,1,49,4439</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpawnsofDiablo,2,50,3883</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">LegendsOnly,3,50,2536</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Assassins,4,50,2032</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Deplorables,5,50,1119</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">WeAreGroot,6,50,1018</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">PlanetExpress,7,50,802</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Resurrected,8,45,770</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Worldwarriors,9,50,656</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">imperialguard2,10,48,652</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Heathens,11,50,567</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Covid,12,50,450</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Sofaklanen,13,50,382</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ActiveOnly,14,50,369</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HiddenLeaf,15,50,303</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">TeamQc,16,50,298</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">F3ARLESS,17,50,297</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Revansheer,18,50,295</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">CatchThzHandz,19,50,277</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ColoradoCasual,20,50,274</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">NuBeginnings,21,50,271</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">MisfitToys,22,50,270</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">WolfiesClan,23,50,256</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">DutchTigers,24,49,241</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">ZeroFukGiven,25,50,237</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SpectralSpartans,26,50,229</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Fighters,27,50,215</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">KINGSnQUEENS,28,50,206</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">FerdaBoys,29,50,192</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Armyofall,30,48,165</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">TurtleGang,31,50,149</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Logitek,32,50,147</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">BreganDaerthe,33,44,146</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">NorthernElysia,34,48,138</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">WarDogz,35,48,132</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Exile,36,50,128</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Fusion,37,50,121</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">TheWarForged,38,50,120</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">13thLegion,39,50,102</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">HordeSmashers,40,50,95</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Dreamwalkers,41,50,90</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Akatsuki,42,50,89</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">DarkfireMambas,43,50,88</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Sparrago,44,50,87</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">Raiders,45,50,84</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">JustForFun,46,50,82</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">WARHAMMER,47,50,77</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">CustardSGood,48,50,76</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">SinCityKnights,49,50,75</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">BigChunges,50,50,74</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_51",51,50,70</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_52",52,50,69</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_53",53,50,66</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_54",54,50,65</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_55",55,50,64</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_56",56,50,60</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_57",57,50,59</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_58",58,50,57</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_59",59,50,56</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_60",60,50,54</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_61",61,50,53</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_62",62,50,53</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_63",63,50,51</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_64",64,47,49</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_65",65,50,48</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_66",66,50,48</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_67",67,50,47</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_68",68,32,42</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_69",69,50,40</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_70",70,50,39</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_71",71,50,38</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_72",72,50,38</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_73",73,19,37</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_74",74,50,36</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_75",75,50,36</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_76",76,50,33</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_77",77,50,33</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_78",78,50,33</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_79",79,50,32</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_80",80,33,30</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_81",81,50,29</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_82",82,50,29</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_83",83,50,29</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_84",84,50,27</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_85",85,50,26</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_86",86,50,25</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_87",87,50,25</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_88",88,50,25</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_89",89,50,24</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_90",90,50,21</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_91",91,50,20</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_92",92,50,20</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_93",93,50,19</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_94",94,12,18</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_95",95,15,17</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_96",96,28,16</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_97",97,50,16</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_98",98,18,16</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_99",99,50,16</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_100",100,50,16</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_101",101,22,16</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_102",102,50,16</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_103",103,43,15</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_104",104,50,15</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_105",105,22,15</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_106",106,50,15</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_107",107,50,15</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_108",108,50,14</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_109",109,50,14</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_110",110,50,14</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_111",111,50,14</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_112",112,50,14</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_113",113,50,14</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_114",114,50,14</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_115",115,50,13</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_116",116,49,13</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_117",117,50,13</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_118",118,48,13</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_119",119,50,13</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_120",120,50,12</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_121",121,50,12</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_122",122,23,12</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_123",123,50,12</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_124",124,50,12</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_125",125,13,11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_126",126,50,11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_127",127,50,11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_128",128,50,11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_129",129,50,11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_130",130,50,11</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_131",131,50,10</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_132",132,50,10</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_133",133,50,10</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_134",134,50,10</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_135",135,50,10</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_136",136,50,10</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_137",137,50,10</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_138",138,50,10</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_139",139,50,9</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_140",140,50,9</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_141",141,50,8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_142",142,50,8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_143",143,50,8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_144",144,50,8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_145",145,50,8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_146",146,50,8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_147",147,50,8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_148",148,50,8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_149",149,50,8</span></p><p class="p1" style="font-family: Menlo; font-size: 13px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;">"clan_150",150,50,7</span></p></div></div>Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-3561838300765495122020-10-14T12:10:00.008-04:002020-10-14T12:19:18.263-04:00User Aware Splunk Dashboards<p>One of the more interesting aspects of Splunk is giving users direct access to raw data. This is great on so many levels from a troubleshooting or investigative perspective. However there are times when you'd rather or need to give people, let's call it, a guided experience to what data they see. This is particularly true when within the same overarching or umbrella organization you have separate lines of business or groups of people such that you don't want to give people direct access to the data; you want/need to limit access at more of the UI level. You might have some data source like a vulnerability scanner where all of the data is coming into one index and you want to give people access to only the scan data that applies to them. One way to accomplish this is by adding search time restrictions to particular roles. While effective this approach can get complex very quickly. The following Splunk .conf talk gets into some great detail (<a href="https://conf.splunk.com/watch/conf-online.html?search=fn1081#/">link</a>). Another approach is to slice and dice what index the data goes into as it is indexed based on the user groups you have setup. This can be effective as well but then data from that singular tool is all over the place and what happens if you are using something like CIDR blocks to map data to index and those CIDR blocks change? In this article I'm going to get into a third approach that is making the dashboard user aware and displays information based on who the user is without giving them native access to the data.</p><p>I should say there are likely several ways to accomplish this that might be more efficient or work better for particular use cases. This worked for me though and can be a good starting point. If you know of other ways to limit data access at the UI level I'd love to hear about them; feel free to put them in the comments!<span></span></p><a name='more'></a><p></p><p>To start we are going to lean on/in on the following</p><p></p><ol style="text-align: left;"><li>Leverage the ability to have a saved search run as the search <i>owner</i> vs search <i>user</i></li><li>The dashboard is going to pass variables/tokens into the saved search based on who the user is</li><li>Use a lookup to map groups of users to specific data</li></ol><div>In order to demo this I'm going to use internal Splunk data to make this somewhat 'run anywhere' and allow you to create this in your environment. Of course the resulting queries aren't game changers so you will need to use a bit of imagination. </div><div><br /></div><div><b>Use Case - </b>What I want to do is give people in group 1 access to the scheduler logs and group 2 to the splunkd_ui_access logs. </div><div><br /></div><div>While I'm using sourcetypes, the concept could still be used for a range of values in a particular field within the same sourcetype: CIDR blocks, building names, names of servers, whatever. To facilitate the ability to dynamically accommodate multiple objects being passed into the saved search I'm going to leverage the "IN" operator. This powerful boolean operator was added into Splunk several years ago and can be used instead of writing out a series of "OR" statements. </div><div><br /></div><div><span style="color: #800180;">index=_internal sourcetype=scheduler OR sourcetype=splunkd_ui_access</span></div><div><br /></div><div>becomes</div><div><br /></div><div><span style="color: #800180;">index=_internal sourcetype IN(scheduler, splunkd_ui_access)</span></div><div><br /></div><div>So let's start building!</div><div><br /></div><div>....I should note there isn't really a set order in how you go through these steps. Just think of them as being all of the pieces that need to be brought together. </div><div><br /></div><div><b>Step 1</b> - create the lookup to map user roles to data</div><div><br /></div><div>Nothing fancy here for this use case. I won't go into how to bring this lookup into Splunk.</div><div><span style="font-family: inherit;"><br /></span></div><div><p class="p1" style="font-size: 15px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;"><span style="font-family: inherit;">role,sourcetype</span></span></p><p class="p1" style="font-size: 15px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;"><span style="font-family: inherit;">group1,scheduler</span></span></p><p class="p1" style="font-size: 15px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;"><span style="font-family: inherit;">group2,splunkd_ui_access</span></span></p><p class="p1" style="font-size: 15px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;"><span style="font-family: inherit;"><br /></span></span></p><p class="p1" style="font-size: 15px; font-stretch: normal; font-variant-east-asian: normal; font-variant-numeric: normal; line-height: normal; margin: 0px;"><span class="s1" style="font-variant-ligatures: no-common-ligatures;"><span style="font-family: inherit;"><br /></span></span></p></div><div><b>Step 2</b> - create roles</div><div><br /></div><div>There are a few ways you can map your users to the data you want them to see. Roles are just one of those ways. In this case I'm simply going to create a role 'shell' which has a name but no real capabilities or limitations. Then you can assign these roles to the users. In this case I'm just creating "group1" and "group2" as that is what I put in my lookup. You will likely already have roles in place that you can use.</div><div><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihrF27t7hHQjjxBnYGm4FBQpbH9UBcfqNATkfQ6YLX_0swq9-LXesePU4IX0ZwhCj9h0LvN3YDKyv1pXpvCweS8dyUHONtCB3-8c-0_LEZY_LO_sS1x60Lm7zOgOPP4j9ue8pmq0uv95xJ/s2788/Screen+Shot+2020-10-13+at+11.26.21+AM.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="514" data-original-width="2788" height="74" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihrF27t7hHQjjxBnYGm4FBQpbH9UBcfqNATkfQ6YLX_0swq9-LXesePU4IX0ZwhCj9h0LvN3YDKyv1pXpvCweS8dyUHONtCB3-8c-0_LEZY_LO_sS1x60Lm7zOgOPP4j9ue8pmq0uv95xJ/w400-h74/Screen+Shot+2020-10-13+at+11.26.21+AM.png" width="400" /></a></div><br /><div><br /></div><div>For this type of use case it can be useful to prepend a common string in the role name to make subsequent queries easier as I will show later. I've also added both of these roles to the admin account for testing purposes (this is just on my laptop instance of Splunk).</div><div><br /></div><div><b>Step 3</b> - create the search to identify who is looking at the dashboard</div><div><br /></div><div>To figure out who the user is that is looking at the dashboard I'm going to leverage the <i>/services/authentication/current-context</i> rest endpoint. There are a several ways to write this query. I'm going to use the following and leave it 'horizontal' for space</div><div><br /></div><div><span style="color: #800180;">| rest splunk_server=local /services/authentication/current-context | stats values(roles) as roles | mvexpand roles | search roles=group* | lookup log_access.csv role as roles | stats values(sourcetype) as sourcetype delim="," | nomv sourcetype</span></div><div><span style="font-family: inherit;"><br /></span></div><div><span style="font-family: inherit;">So what does this query do? The first bit is just finding out who the user is. Now we probably don't need the stats command but I wanted to make sure I get all the roles in case there is some edge case where multiple lines show up (not likely). The mvexpand command splits out the results so that you get one line per role which allows me to then get just the roles I'm interested in with the search command that follows. At this point we can map each of these roles back to our lookup. Now we need to collapse down the sourcetypes we are going to pass to our saved searches in a way that is comma delimited. The fancy stats command delim bit gets us that. Interestingly enough you can't see that unless you do the nomv command after and if there is only 1 item Splunk is smart enough to realize you don't need the comma!</span></div><div><span style="font-family: inherit;"><br /></span></div><div><span style="font-family: inherit;">Once the query is to your liking go ahead and add that to a dashboard. I normally keep that query panel at the top of the dashboard (and we will hide it later).</span></div><div><br /></div><div><b>Step 4</b> - create the saved searches</div><div><br /></div><div>For this use case I'm just going to have 2 panels - one showing the number of all events and the other showing the number of events by sourcetype and user. I'll create and save those as Data_Access_Event_Count and Data_Access_Sourcetype_User_Count respectively. Those searches are</div><div><br /></div><div><span style="color: #800180;">index=_internal sourcetype IN(scheduler, splunkd_ui_access) | stats count</span></div><div><span style="color: #800180;">index=_internal sourcetype IN(scheduler,splunkd_ui_access) | stats count by sourcetype user</span></div><div><br /></div><div>Several ways to save searches but ultimately you will want to do a few things. </div><div><ol style="text-align: left;"><li>Change permissions on the searches so that only the right folks should be able to see/edit them (don't keep them as Private)</li><li>Adjust the query so that the items within the parentheses contain some variable name that is wrapped with dollar signs. I'm boring so I literally used "variable" (ie <span style="color: #800180;">sourcetype IN($variable$)</span> )</li><li>Make sure the query is setup to run as the owner and not the user. From the nav bar in the top right go to Settings > Searches, reports, and alerts > 'Edit' on the search of interest > Edit Permissions > in here you want to select Run as User vs run as Owner</li></ol><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiL4CuW1GZnWKsUMrZ0y7cqBEdV7gbufXgn4VPtk0A36AbN2JiED_7uGJLWcZ3DSdZBfp1s2kkli9QR5dA_Jl7MCTKoSjP1cJYREscPLVFmNAk6DK1WqZoIlQEYUEcejzyTQQRYPOaHn-vD/s1062/Screen+Shot+2020-10-13+at+4.36.39+PM.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="580" data-original-width="1062" height="219" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiL4CuW1GZnWKsUMrZ0y7cqBEdV7gbufXgn4VPtk0A36AbN2JiED_7uGJLWcZ3DSdZBfp1s2kkli9QR5dA_Jl7MCTKoSjP1cJYREscPLVFmNAk6DK1WqZoIlQEYUEcejzyTQQRYPOaHn-vD/w400-h219/Screen+Shot+2020-10-13+at+4.36.39+PM.png" width="400" /></a></div></div><p> You can also go into the advanced edit option > dispatchAs > and change that to user if you wanted.</p><p><b>Step 5 </b>- add your saved searches to your dashboard</p><p>So navigate to the dashboard you created in step 3 and here we will add panels for the saved searches. Now in a slightly ironic twist instead of linking directly to the report we are going to call them through an inline search. We also need to pass the output from the search we created in step 3 to these searches. We haven't done this yet but we are going to tie that output to a token to pass into these searches. For demonstration purposes I'm going to set my token to be "token-sourcetype". Recall that in Step 4.2 I created a token reference called "variable". So with all of this information the queries I'm going to create panels around look like the following</p><p><span style="color: #800180;">| savedsearch Data_Access_Event_Count variable="$token-sourcetype$"</span></p><p><span style="color: #800180;">| savedsearch Data_Access_Sourcetype_User_Count variable="$token-sourcetype$"</span></p><p>When you create these panels they will give you an error. Don't worry that will be fixed.</p><p>It is important to put double quotes around the token you are passing into the saved search - in my case "$token-sourcetype$". If you don't, Splunk will essentially stop reading your results at the comma and process only the first value in your results.</p><p><b>Step 6</b> - update the XML related to the user query from step 3</p><div><div>So we have our dashboard with three panels on the dashboard that might look something like this</div></div><div><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVH939Ru75JbwBbsDrvYFldBtGG9WYciBWt3M_UmLxJ7S6j6JYTxrfjgaov-jc4gQWOdNIEr416tKdRINbiJyVOUT0oCPW8PpIpJSjRznOq5KK1KE5WQP__4i6GtnLnmUEYxNBWm5IDVJD/s1892/Screen+Shot+2020-10-14+at+11.33.02+AM.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1006" data-original-width="1892" height="213" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVH939Ru75JbwBbsDrvYFldBtGG9WYciBWt3M_UmLxJ7S6j6JYTxrfjgaov-jc4gQWOdNIEr416tKdRINbiJyVOUT0oCPW8PpIpJSjRznOq5KK1KE5WQP__4i6GtnLnmUEYxNBWm5IDVJD/w400-h213/Screen+Shot+2020-10-14+at+11.33.02+AM.png" width="400" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><br /></div><br /><div><br /></div><div><br /></div><div>Now we need to have that first panel set the "token-sourcetype" token and hide the panel. We will set the token from the sourcetype field from the results of the query in this panel. That bit looks like this in the XML view</div><div><br /></div><div><span style="color: #800180;"><set token="token-sourcetype">$result.sourcetype$</set></span></div><div><br /></div><div>and the panel can be hidden by adding a 'depends' to the table for a token that will never get a value.</div><div><br /></div><div><span style="color: #800180;"><table depends="$hide_me$"></span></div><div><br /></div><div>So going from </div><div><br /></div><div><span style="color: #800180;">....</span></div><div><div><span style="color: #800180;"> <table></span></div><div><span style="color: #800180;"> <search></span></div><div><span style="color: #800180;"> <query>| rest splunk_server=local /services/authentication/current-context | stats values(roles) as roles | mvexpand roles | search roles=group* | lookup log_access.csv role as roles | stats values(sourcetype) as sourcetype delim="," | nomv sourcetype</query></span></div></div><div><span style="color: #800180;">.....</span></div><div><br /></div><div>to</div><div><br /></div><div><span style="color: #800180;">....</span></div><div><div><span style="color: #800180;"> <table depends="$hide_me$"></span></div><div><span style="color: #800180;"> <search></span></div><div><span style="color: #800180;"> <done></span></div><div><span style="color: #800180;"> <set token="token-sourcetype">$result.sourcetype$</set></span></div><div><span style="color: #800180;"> </done></span></div><div><span style="color: #800180;"> <query>| rest splunk_server=local /services/authentication/current-context | stats values(roles) as roles | mvexpand roles | search roles=group* | lookup log_access.csv role as roles | stats values(sourcetype) as sourcetype delim="," | nomv sourcetype</query></span></div></div><div><span style="color: #800180;">....</span></div><div><br /></div><div>Now our dashboard (with both roles) looks something like this. Note that I'm just looking at my internal logs and I've added some coloring in the second panel to highlight the different sourcetypes</div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzKp5fy3Fb1qDHDXHM-RhGJ_CIS8V83S5iYJsKAWv5xG2q6LUTQVJF4YH82LfUG_CaFPSAjU2d33E7HTMB1bcJC3HuosDFbXW4FyF5e-qFpqQpO6ogsBf5FBbtnN0SrFAnAUSxEPNZtTvH/s1886/Screen+Shot+2020-10-14+at+11.34.29+AM.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="930" data-original-width="1886" height="198" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzKp5fy3Fb1qDHDXHM-RhGJ_CIS8V83S5iYJsKAWv5xG2q6LUTQVJF4YH82LfUG_CaFPSAjU2d33E7HTMB1bcJC3HuosDFbXW4FyF5e-qFpqQpO6ogsBf5FBbtnN0SrFAnAUSxEPNZtTvH/w400-h198/Screen+Shot+2020-10-14+at+11.34.29+AM.png" width="400" /></a></div><br /><div><br /></div><div><b>Step 7</b> - test test test</div><div><br /></div><div>As with anything you will want to test what you've created. There are several test options to include adding a panel that maybe shows the actual results of the search that identifies what roles the viewing user has as you work through "is the right data being displayed for the individual groups". You can also, while logged into the admin account, adjust that hidden search to show results of different groups; I referenced this a bit earlier. Basically you adjust which group(s) the search should target.</div><div><br /></div><div><span style="color: #800180;">| rest splunk_server=local /services/authentication/current-context | stats values(roles) as roles | mvexpand roles <span style="background-color: #fcff01;">| search roles=group*</span> | lookup log_access.csv role as roles | stats values(sourcetype) as sourcetype delim="," | nomv sourcetype</span></div><div><span style="color: #800180;"><br /></span></div><div>What is nice (at least to me who is easily amused) is you can edit the search in the UI edit mode vs having to dive into the XML view. Of course you will also want to actually log in as a test account with the various roles to make sure they can get to the dashboard and things otherwise look good.</div><div><br /></div><div>While that seems like a lot of steps and making sure you keep track of what you call things the approach is generally pretty straight forward. At this point you might want to add things like a custom time range picker. If you want add different filters for the users like a dropdown remember you will need to accommodate them in your saved search and the panel searches via tokens (steps 4, 5, & 6)</div><div><br /></div><div>Hopefully this was helpful! Are there other ways or approaches you've used to accomplish the same thing? Would love to hear about them.</div><div><br /></div><div>I'll go ahead and paste my full dashboard XML and highlight some pertinent parts.</div><div><br /></div><div><div><dashboard></div><div> <label>Data Access Test</label></div><div> <row></div><div> <panel></div><div> <title>hide me</title></div><div><span style="background-color: white;"> </span><span style="background-color: #fcff01;"><table depends="$hide_me$"></span></div><div> <search></div><div> <done></div><div> <span style="background-color: #fcff01;"><set token="</span><span style="background-color: #04ff00;">token-sourcetype</span><span style="background-color: #fcff01;">"></span><span style="background-color: #01ffff;">$result.sourcetype$</span><span style="background-color: #fcff01;"></set></span></div><div> </done></div><div> <query>| rest splunk_server=local /services/authentication/current-context | stats values(roles) as roles | mvexpand roles | search roles=group* | lookup log_access.csv role as roles | stats values(sourcetype) as sourcetype delim="," | nomv sourcetype</query></div><div> <earliest>-24h@h</earliest></div><div> <latest>now</latest></div><div> <sampleRatio>1</sampleRatio></div><div> </search></div><div> <option name="count">100</option></div><div> <option name="dataOverlayMode">none</option></div><div> <option name="drilldown">none</option></div><div> <option name="percentagesRow">false</option></div><div> <option name="rowNumbers">false</option></div><div> <option name="totalsRow">false</option></div><div> <option name="wrap">true</option></div><div> </table></div><div> </panel></div><div> </row></div><div> <row></div><div> <panel></div><div> <title>Event Counts</title></div><div> <single></div><div> <search></div><div> <query><span style="background-color: #fcff01;">| savedsearch Data_Access_Event_Count variable="</span><span style="background-color: #04ff00;">$token-sourcetype$</span><span style="background-color: #fcff01;">"</span></query></div><div> <earliest>$field1.earliest$</earliest></div><div> <latest>$field1.latest$</latest></div><div> </search></div><div> <option name="drilldown">none</option></div><div> <option name="refresh.display">progressbar</option></div><div> </single></div><div> </panel></div><div> </row></div><div> <row></div><div> <panel></div><div> <title>Event Counts by Sourcetype &amp; User</title></div><div> <table></div><div> <search></div><div> <query><span style="background-color: #fcff01;">| savedsearch Data_Access_Sourcetype_User_Count variable="</span><span style="background-color: #04ff00;">$token-sourcetype$</span><span style="background-color: #fcff01;">"</span></query></div><div> <earliest>$field1.earliest$</earliest></div><div> <latest>$field1.latest$</latest></div><div> </search></div><div> <option name="drilldown">none</option></div><div> <format type="color" field="sourcetype"></div><div> <colorPalette type="sharedList"></colorPalette></div><div> <scale type="sharedCategory"></scale></div><div> </format></div><div> </table></div><div> </panel></div><div> </row></div><div></dashboard></div></div><p></p>Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-47213128555573635312020-05-26T12:24:00.004-04:002020-06-02T10:10:46.050-04:00Drilling into the OTHER category in SplunkSo what has broken my 3 year blog posting hiatus you might ask? Some nerd-like delight in working through a Splunk dashboard capability I didn't realize was there!<br />
<br />
Several days ago some fellow Splunk users asked if there was a way to drill into the "OTHER" category. They had an overview dashboard with a bar chart viz allowing the user to pivot to a more detailed interactive dashboard. The challenge was the overview graphic leveraged Splunk's ability to show the top N results with the rest of the results up as OTHER. The interactive dashboard didn't like receiving OTHER as that wasn't a value in the data. I tried a few different approaches but they honestly didn't work. Through that effort though I stumbled upon the ability to set a condition match in XML.<br />
<br />
Wait whuuut? I've known about condition match from adjusting navigation bars in Splunk and it turns out this capability is also available in dashboards themselves. Could I use this mechanism for the use case at hand?<br />
<a name='more'></a><br />
I should mention that I'm really not a programmer nor have much programming background. I do employ the second most common programming language though - steal. As in I'm going to find some examples and steal them. Incidentally the most common programming language is of course Excel - unless you are a Splunk user and bring those spreadsheets into Splunk for analysis.<br />
<br />
Queue up the A-Team inspired, Mandalorian spaceship rebuilding, Google searching montage.<br />
<br />
Ok so searching done and trial and error completed I have success! As I didn't find anything along the lines of this use case I figured I'd write it up. To demonstrate I'm going to use the internal Splunk logs using the 'component' field to group by. I want to start with my top 10 component categories. If a user clicks on any one of them I want the drill down to take them to the interactive dashboard. If they click on the OTHER category I want the drill down to take them to a dashboard that shows them categories 11 through N. They can then select one of these categories which will take them to the interactive dashboard. Something like this<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpj2T8lxtdYj4MBuTW2JtEk4AgNpRclqoytRDeNK5Og_17GhnjNij3N9uhOSQo-bbS5A49D6X5tOrXJulfM8ZXFKDYD8OhyphenhyphendKMgvo5YjnnW37Mb36VJNxP_eMjlUti-8EMnhieHSNTET1O/s1600/OTHER+Flow.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" data-original-height="711" data-original-width="1600" height="283" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpj2T8lxtdYj4MBuTW2JtEk4AgNpRclqoytRDeNK5Og_17GhnjNij3N9uhOSQo-bbS5A49D6X5tOrXJulfM8ZXFKDYD8OhyphenhyphendKMgvo5YjnnW37Mb36VJNxP_eMjlUti-8EMnhieHSNTET1O/s640/OTHER+Flow.png" width="640" /></a></div>
<br />
<br />
The initial visualization is populated with the following search<br />
<br />
<span style="color: blue;">index=_internal component!=metrics | top component useother=1</span><br />
<br />
I'm not showing the metrics log/component because it totally skews the chart =).<br />
<br />
Being the relatively lazy person I am I'd like to have Splunk figure out pieces of this. The first thing I do is use the UI to figure out the drill down from my visualization to the interactive dashboard. That results in something like this which I pull out from the XML view<br />
<br />
<span style="color: purple;"><drilldown></span><br />
<span style="color: purple;"> <link target="_blank">/app/playground/splunk_logging_component_investigator?form.component_drilldown=$click.value$</link></span><br />
<span style="color: purple;"></drilldown></span><br />
<br />
Back to the UI view I reset the drill down to my dashboard showing items 11 and beyond. That results in the following<br />
<br />
<span style="color: purple;"><drilldown></span><br />
<span style="color: purple;"> <link target="_blank">/app/playground/components_11_to_n</link></span><br />
<span style="color: purple;"></drilldown></span><br />
<br />
Incidentally the query I use to populate that dashboard is<br />
<br />
<span style="color: blue;">index=_internal sourcetype=splunkd component!=metrics NOT [search index=_internal sourcetype=splunkd component!=metrics | top component | fields component] | stats count by component | sort -count</span><br />
<br />
Now - flip back to the XML view and putting the pieces together you do something like this<br />
<br />
<span style="color: purple;"><drilldown></span><br />
<span style="color: purple;"> <condition match="'click.value'= &quot;OTHER&quot;"></span><br />
<span style="color: purple;"> <link target="_blank">/app/playground/components_11_to_n</link></span><br />
<span style="color: purple;"> </condition></span><br />
<span style="color: purple;"> <condition match="'click.value'!= &quot;OTHER&quot;"></span><br />
<span style="color: purple;"> <link target="_blank">/app/playground/splunk_logging_component_investigator?form.component_drilldown=$click.value$</link></span><br />
<span style="color: purple;"> </condition></span><br />
<span style="color: purple;"></drilldown></span><br />
<br />
The first condition checks to see if the clicked value is OTHER, the second looks for everything else.<br />
<br />
Insert self congratulatory shout in my makeshift office due to Coronavirus lol.<br />
<br />
So what about something different? I hadn't ever played with hidden panels. What if the user clicked OTHER a hidden panel appeared that showed the 11th+ categories on the same dashboard? Depending on what your initial dashboard looks like that might be better UX.<br />
<br />
Insert another Googling montage.<br />
<br />
Before setting up the hidden panel you first have to layout the dashboard pieces. My initial dashboard now looks like this where the first chart works as outlined above. The second one shows the same data but if you click Other it will unhide the third panel.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUYD8Yqunw2mSqTIWQDnZ5pFyRSGiA1lqHERHxouMENE6Sm9sOAk6SfNdU1FbyRHYvwK8IHIVdtc93A5zumJonENh1ItJ1uhEXwOKr5WfVc_DthsapxUAFkXsxWUN33ERUrjrxSjJyFhLx/s1600/Hidden+Panel.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" data-original-height="575" data-original-width="1600" height="228" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUYD8Yqunw2mSqTIWQDnZ5pFyRSGiA1lqHERHxouMENE6Sm9sOAk6SfNdU1FbyRHYvwK8IHIVdtc93A5zumJonENh1ItJ1uhEXwOKr5WfVc_DthsapxUAFkXsxWUN33ERUrjrxSjJyFhLx/s640/Hidden+Panel.png" width="640" /></a></div>
<br />
<br />
It appears the main way you hide/show a panel is to use the "depends" condition on the panel itself. There are likely several (better) ways to do this.<br />
<br />
<span style="color: purple;"><panel depends="$your_token_here$"></span><br />
<br />
To get it to show then we need to set the token within the correct condition segment. Since the logic seems to be "does this token have a value?" I put in "yep".<br />
<br />
<span style="color: purple;"><drilldown></span><br />
<span style="color: purple;"> <condition match="'click.value'= &quot;OTHER&quot;"></span><br />
<span style="color: purple;"><span style="background-color: white;"> </span><span style="background-color: cyan;"><set token="show_OTHER_items">yep</set></span></span><br />
<span style="color: purple;"> </condition></span><br />
<span style="color: purple;"> <condition match="'click.value'!= &quot;OTHER&quot;"></span><br />
<span style="color: purple;"> <link target="_blank">/app/playground/splunk_logging_component_investigator?form.component_drilldown=$click.value$</link></span><br />
<span style="color: purple;"> </condition></span><br />
<span style="color: purple;"></drilldown></span><br />
<br />
With the third panel's XML looking like<br />
<br />
<span style="color: purple;"> <row></span><br />
<span style="color: purple;"> <span style="background-color: cyan;"><panel depends="$show_OTHER_items$"></span></span><br />
<span style="color: purple;"> <title>The "Other" Components</title></span><br />
<span style="color: purple;"> <table></span><br />
<span style="color: purple;"> <search></span><br />
<span style="color: purple;"> <query>index=_internal sourcetype=splunkd component!=metrics NOT [search index=_internal sourcetype=splunkd component!=metrics | top component | fields component] | stats count by component | sort -count</query></span><br />
<span style="color: purple;"> <earliest>-4h@m</earliest></span><br />
<span style="color: purple;"> <latest>now</latest></span><br />
<span style="color: purple;"> <sampleRatio>1</sampleRatio></span><br />
<span style="color: purple;"> </search></span><br />
<span style="color: purple;"> <option name="count">20</option></span><br />
<span style="color: purple;"> <option name="dataOverlayMode">none</option></span><br />
<span style="color: purple;"> <option name="drilldown">row</option></span><br />
<span style="color: purple;"> <option name="percentagesRow">false</option></span><br />
<span style="color: purple;"> <option name="rowNumbers">false</option></span><br />
<span style="color: purple;"> <option name="totalsRow">false</option></span><br />
<span style="color: purple;"> <option name="wrap">true</option></span><br />
<span style="color: purple;"> <drilldown></span><br />
<span style="color: purple;"> <link target="_blank">/app/playground/splunk_logging_component_investigator?form.component_drilldown=$click.value$</link></span><br />
<span style="color: purple;"> </drilldown></span><br />
<span style="color: purple;"> </table></span><br />
<span style="color: purple;"> </panel></span><br />
<span style="color: purple;"> </row></span><br />
<span style="color: purple;"><br /></span>
I've always appreciated Splunk creating the Splunk Dashboard Examples app (<a href="https://splunkbase.splunk.com/app/1603/" target="_blank">link</a>) though would be great if they had both a condition and hidden panel example. Perhaps in a future version.<br />
<br />
Hopefully someone will find this helpful!Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-47876832161294514292017-01-14T14:08:00.001-05:002017-01-14T14:08:52.660-05:00Adjusting Splunk forwarder phonehome / throughputI was in the process of writing up a few things for a new EDU that is going to be spinning up a larger scale Splunk environment and figured if I was going to the effort it might as well be placed here for others to see. In working with my own environment today I realized I was making some adjustments that I take for granted but that we had to learn and bake in. For this installment these items are focused on the following:<br />
<br />
<ol>
<li>Adjusting the forwarder to deployment server phone home interval</li>
<li>Allowing forwarders to send more than 256 kbps</li>
</ol>
<div>
<a name='more'></a></div>
<div>
By default forwarders will phonehome every 60s. In order to allow 1 deployment server to scale out as you increase the number of forwarders you have you will want to back this interval down. In some environments I've heard of people having the forwarders check in only once an hour. While we don't go that far the reality is once you have things setup for a new host/unit/whatever you will generally not make changes so very infrequent checkins are fine. Here are a few things I'd recommend:</div>
<div>
<br /></div>
<div>
<b>1.a - set a baseline interval for all forwarders that is other than 60s</b></div>
<div>
Config: deploymentclient.conf</div>
<div>
<br /></div>
<div>
Not only do you want to back off how often a forwarder checks in for scaling purposes but this also will help in troubleshooting efforts. For example through whatever method you deploy the adjusted phonehome interval if you are trying to figure out why a particular host forwarder isn't sending logs and it is still checking in every 60s then it hasn't received the configuration package you are pushing. We have a relatively old deployment and to account for what we thought was a bug we added the config line to both stanzas</div>
<div>
<br /></div>
<div>
<blockquote class="tr_bq">
<span style="color: blue;">[deployment-client]<br />phoneHomeIntervalInSecs = <your setting> </span></blockquote>
<blockquote class="tr_bq">
<span style="color: blue;">[target-broker:deploymentServer]<br />phoneHomeIntervalInSecs = <your setting></span></blockquote>
</div>
<div>
<br /></div>
<div>
<b>1.b - create a package that overwrites your baseline</b></div>
<div>
<br /></div>
<div>
Now that all of your forwarders are checking in more infrequently you will want a serverclass.conf stanza that causes forwarders of choice to check in more frequently. This is helpful for systems like maybe syslog servers that you might interact with more frequently, hosts where you are onboarding new data, or maybe forwarders you are troubleshooting. There are any number of ways to accomplish this but since you want all forwarders to get your baseline I suggest leveraging <a href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles" target="_blank">Splunk order of precedence</a>. In our case we typically use lower case when we name our packages so we use upper case for overwrites. </div>
<div>
<br /></div>
<div>
<b>1.c - create an eventtype for the phonehome logs</b></div>
<div>
Config: eventtypes.conf</div>
<div>
<br /></div>
<div>
You'd likely want to create a search on a search head allowing you to see when forwarders are phoning home. While everyone's environment is different we'd suggest instead creating an eventtype and pushing that to your search head(s) via the deployment server. Call it whatever you want; ours is splunk-phone-home and the config looks like this. Pulling back the lens on this you can put this in a stand alone app you push to the search heads or maybe create a generic admin to put global admin stuffs in. </div>
<blockquote class="tr_bq">
<br /><span style="color: blue;">[splunk-phone-home]<br />search = index=_internal sourcetype=splunkd_access "/services/broker/phonehome/connection" NOT 0ms</span></blockquote>
<div>
<br /></div>
<div>
<b>1.d - increase timeout on your deployment server reload command</b></div>
<div>
<br /></div>
<div>
This is somewhat related to the topic at hand. As Splunk versions have increased we've had to back down our phonehome interval or receive a socket error on our deployment server when we issue a reload deploy-server command. This probably has more to do with the number of configuration packages/apps we push from our deployment server than specifically how many forwarders are checking in. Sadly there isn't a config setting you can adjust and by default the setting is 30sec. To help I've created the following Linux OS alias for my account on the deployment server: </div>
<div>
<br /></div>
<div>
date && /opt/splunk/bin/splunk reload deploy-server -timeout 180</div>
<div>
<br /></div>
<div>
<br /></div>
<div>
<b>2.a - identifying forwarders that are trying to send more than 256 kbps</b></div>
<div>
<br /></div>
<div>
By default forwarders will only send data at a rate of 256 kbps. One way to see this in action is when you search for data from that host only to notice a time gap in your data. The forwarder does generate internal logs indicating the forwarder is hitting the limit. The <a href="https://splunkbase.splunk.com/app/1850/" target="_blank">Forwarder Health</a> app was created, in part, to identify this. Other than installing that app the base search we use is</div>
<div>
<br /></div>
<div>
<span style="color: blue;">index=_internal sourcetype=splunkd "current data throughput" | rex "Current data throughput \((?<kb>\S+)" | eval rate=case(kb < 500, "256", kb > 499 AND kb < 520, "512", kb > 520 AND kb < 770 ,"768", kb>771 AND kb<1210, "1024", 1=1, ">1024") | stats count as Count sparkline as Trend by host, rate | where Count > 4 | rename rate as "Throughput rate(kb)" | sort -"Throughput rate(kb)",-Count</span></div>
<div>
<br /></div>
<div>
The 'where' part is designed to limit false positives when a forwarder is restarted and/or there is just a slight bump in log volume. </div>
<div>
<br /></div>
<div>
<b>2.b - create multiple throughput apps/packages</b></div>
<div>
Config: limits.conf</div>
<div>
<br /></div>
<div>
There are a couple options when it comes to increasing the throughput for forwarders. If your environment can handle it you could just open the gates and let the forwarders blast all their data. The other is to take a stepped approach. This is what we've done. In order to help us layer these packages we again leverage Splunk config order of precedence and generally name our packages like this:</div>
<div>
<br /></div>
<div>
<div>
throughput_limits_100_unlimited</div>
<div>
throughput_limits_200_1024</div>
<div>
throughput_limits_300_0768</div>
<div>
throughput_limits_400_0512</div>
</div>
<div>
<br /></div>
<div>
This gives us a couple options. For example if a unit's servers generally send a lot of data we can create a serverclass.conf stanza that sets all their forwarders to 512 but we can also set 1 server to something higher than that without having to back out that server from the 512 stanza. Somewhat implied is that you've created stanzas in serverclass.conf for each of those packages where you can add servers or units via whitelist. </div>
<div>
<br /></div>
<div>
<b>Summary</b></div>
<div>
<br /></div>
<div>
Hopefully you've found the above useful! Putting these in place are a few of the quality of life things we've done from an administrator's perspective that help us manage a large and diverse environment.</div>
<div>
<br /></div>
<div>
<br /></div>
<div>
<br /></div>
<br />
<style type="text/css">
p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 14.0px Calibri; -webkit-text-stroke: #000000}
span.s1 {font-kerning: none}
</style><style type="text/css">
p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 14.0px Calibri; -webkit-text-stroke: #000000}
span.s1 {font-kerning: none}
</style>Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-74268324793051057062016-11-20T16:12:00.001-05:002016-11-20T16:12:06.425-05:00Find saved searches in Splunk that are failingI hope to circle back to this eventually. Until then --- enjoy:<br />
<br />
index=_internal log_level=ERROR SavedSplunker | stats count as Count by host message | rex field=message "savedsearch_id=\"(?<Author>[^;]+);(?<App>[^;]+);(?<Search>[^\"]+)\"(?:, message=)?(?<Message>.+)" | table host App Search Author Message Count | eventstats sum(Count) as total by host | eventstats sum(Count) as foo by host App | sort -total -foo -Count | fields - total fooMarkhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-40040458889397845692016-04-09T09:55:00.003-04:002016-04-09T09:55:47.512-04:00Splunk admin tasks after you start getting data in...I had the rather unique privilege to post a 3 part blog series on Splunk's official site recently. The focus was on some administration tasks Splunk admins should work into their routine. There is a level of assumption when users search in Splunk - these hosts are really these hosts and events that are observed within a time range really happened then. The series talks through a couple methodologies to validate those assumptions<br />
<br />
<ul>
<li>Part 1 - Validating host field values: <a href="http://blogs.splunk.com/2016/02/11/whats-next-next-level-splunk-sysadmin-tasks-part-1/" target="_blank">link</a></li>
<li>Part 2 - Validating agent host's system time: <a href="http://blogs.splunk.com/2016/02/16/whats-next-next-level-splunk-sysadmin-tasks-part-2/" target="_blank">link</a></li>
<li>Part 3 - Getting a feel for data ingestion latency: <a href="http://blogs.splunk.com/2016/02/24/whats-next-next-level-splunk-sysadmin-tasks-part-3/" target="_blank">link</a></li>
</ul>
Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-52188278780309349352015-10-29T09:10:00.003-04:002015-10-29T14:05:17.444-04:00Moving toward Splunk's CIMFor those that don't know, for some time Splunk has been moving toward a Common Information Model (CIM). They are using this both a data normalization effort - what should you name fields from particular data sources - as well as a layer of abstraction placed over your data to indicate what the data IS. In the end this is a worthwhile effort though the devil is in the details for those of us with 1) older - by whatever definition - Splunk instances with local extractions and 2) larger - again by whatever definition - Splunk instances with 3) a large - sensing a trend? - number of sourcetypes. Frankly I'm big time scared of the performance implications of using what was a second or third class citizen in Splunk (tags) as my primary source of querying across 1k sourcetypes and 15B logs per day. Martin Mueller had a great talk at .conf15 looking into performancy sorts of things which brings a lot to that aspect of the discussion (search for his name <a href="http://conf.splunk.com/speakers.html#" target="_blank">here</a> for a link to the slides. His name is actually spelled Martin Müeller and a direct link to the pdf is ><a href="http://conf.splunk.com/session/2015/conf2015_MMueller_Consist_Deploying_OptimizingSplunkKnowledge.pdf" target="_blank">here</a><).<br />
<br />
Performance concerns aside the question is how do you go about a discovery effort to figure out which of your sourcetypes should map to which CIM based data model? In theory and based on the number of sourcetypes you have you could do this by manually reviewing a list. That might work for some percentage of sourcetypes but perhaps not all. At any rate some of this is addressable by the new Splunk commands: pivot and datamodel. The challenge with those is they are essentially searching across your data with the fields contained within the model in a one off basis (one DM at a time) and if the fields don't match then there simply is no results. What I was wanting was a way to take all of the fields from my data and throw that up against all of the fields in all of the models with a side of fuzzy string comparison. I *think* I have found a way.<br />
<br />
<a name='more'></a><br />
The first bit is to know what fields you have per sourcetype. That is surprisingly challenging but I have that built out in the Data Curator app with the saved search "build sourcetype_field csv". (Note if you are just now installing the Data Curator app based on this post you should run that search or let the app bake a bit before proceeding). The next piece is to build a list of fields from the data models. I was going to try to do that with something like a rest search (ie | rest /servicesNS/-/-/datamodel/model | search title=alerts | table title description) but that proved problematic so I knuckled down and manually created a list which I will post below. I left off a few models like Alerts, Application State, Change Analysis, Inventory, etc as those are somewhat niche and don't generally contain unique field names. I also cut out the fields leveraged by the premium apps like ES (ie *_bunit, *_category, *_priority). Now 'all' that is left is to compare the list.<br />
<br />
The thing I wondered about was in cases where the field name from the DM was close but not exactly like what we've named our fields locally. For example suppose we have a field names like MAC, mac, clientmac, etc how do you map that back to the CIM fields which are along the lines of src_mac or dest_mac?<br />
<br />
<b>Approach 1</b>: Levenshtein distance<br />
The Levenshtein distance is a number representing how many edits would have to be made in order to match one word/string to another. I liked this idea on a couple levels as there might be other use cases where it would be useful and there actually is an app in Splunkbase. Ultimately I didn't pursue it.<br />
<br />
<b>Approach 2</b>: Cluster command using n-gram (match=ngramset)<br />
I poked at this for a bit which was kinda fun but I started having to use lots of subsearches and joins as I was having to compare the fields, come up with a cluster ID, and then reach back through my base DM fieldset to associate that same cluster ID to the fields in a particular dm and object. In looking at the initial results though it seemed that using wildcards in a lookup would accomplish just about the the same thing AND be easier to manipulate the results for use.<br />
<br />
<b>Approach 3</b>: Lookup with wildcards<br />
I should get more into the habit of using kv stores but that aside what I did here was take my list and wrap wildcards around just about all of the field names. The ones I didn't though were src, dest, & dvc as those have the potential to match a great many fields and skew the results. I also added *referer* to the Web model and *mac* to the Network Traffic one as both seemed to make sense - *mac* will match things like machine though so something to keep in mind. This does require that you can go under the hood to add a transform like this<br />
<br />
<div class="p1">
<span class="s1">[dm_fields]</span></div>
<div class="p1">
<span class="s1">filename = data_models.csv</span></div>
<div class="p1">
<span class="s1">match_type = WILDCARD(field)</span></div>
<div class="p1">
<span class="s1">max_matches = 1</span></div>
<div class="p1">
<span class="s1">min_matches = 1</span></div>
<div class="p1">
<span class="s1"><br /></span></div>
<div class="p1">
<span class="s1">The search then is pretty simple</span></div>
<div class="p1">
<span class="s1"><br /></span></div>
<div class="p1">
<span class="s1">
</span></div>
<div class="p1">
<span class="s1"><span style="color: blue;">| inputlookup sourcetype_fields.csv | eval field = lower(field) | lookup dm_fields field as field | search model!=none | stats dc(field) as fields values(field) as field_list by sourcetype model object | where fields > 1 | sort -fields | stats max(fields) as maxFieldMatch list(model) as Model list(object) as Object list(fields) as fieldMatch by sourcetype | sort -maxFieldMatch</span></span></div>
<div class="p1">
<span class="s1"><span style="color: blue;"><br /></span></span></div>
<div class="p1">
<span class="s1">The results of the search in my environment are what you might call directionally correct moreso than exact =). There are quite a number of good, actionable results but much of the depends on what fields names you have defined already. One thing I did pre CIM years ago was settle on src_ip and dest_ip for IP address related fields so we already had that baked into many of our sourcetypes. If you've used source_ip or destination_ip you might want to look into adjusting the lookup. I also saw a fair bit of matches for both Web and Network Traffic for the same sourcetype as there is fair bit of field naming overlap. Not to be out done the Windows Security logs had 5 matches: Web, Email (filtering & email objects), Network Traffic, and Authentication. </span></div>
<div class="p1">
<span class="s1"><br /></span></div>
<div class="p1">
<span class="s1">The other cool thing I like about having multiple stats commands is if you click on a sourcetype in the results and then on "View events" you will be brought down to the query results just after the first stats command for that sourcetype. This will then show you all the fields that were matched. You could adjust the query to show the fields as part of the overall results but it will lengthen the output making it more difficult to visually consume.</span></div>
<div class="p1">
<span class="s1"><br /></span></div>
<div class="p1">
<span class="s1">Here is the csv I used. As listed in the transforms above I named it data_models.csv though you could call it whatever. If you have any feedback to the list below or the methodology I'm all ears!</span></div>
<div class="p1">
<br /></div>
<div class="p1">
<span class="s1">field,model,object</span></div>
<div class="p1">
<span class="s1">"*bytes*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*bytes_in*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*bytes_out*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*cached*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*cookie*",Web,Web</span></div>
<div class="p1">
<span class="s1">dest,Web,Web</span></div>
<div class="p1">
<span class="s1">"*duration*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*http_content_type*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*http_method*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*http_referrer*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*http_user_agent*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*http_user_agent_length*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*referer*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*response_time*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*site*",Web,Web</span></div>
<div class="p1">
<span class="s1">src,Web,Web</span></div>
<div class="p1">
<span class="s1">"*src_ip*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*status*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*uri_path*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*uri_query*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*url*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*url_length*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*user*",Web,Web</span></div>
<div class="p1">
<span class="s1">"*bytes*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*bytes_in*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*bytes_out*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*channel*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">dest,"Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*dest_interface*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*dest_mac*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*dest_port*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*dest_translated_ip*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*dest_translated_port*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*direction*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*duration*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">dvc,"Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*flow_id*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*icmp_code*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*icmp_type*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*mac*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*packets*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*packets_in*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*packets_out*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*protocol*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*protocol_version*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*response_time*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*rule*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*session_id*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">src,"Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*src_interface*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*src_ip*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*src_mac*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*src_port*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*src_translated_ip*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*src_translated_port*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*ssid*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*tcp_flag*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*transport*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*tos*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*ttl*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*user*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*vlan*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">"*wifi*","Network_Traffic","All_Traffic"</span></div>
<div class="p1">
<span class="s1">dest,Authentication,Authentication</span></div>
<div class="p1">
<span class="s1">"*dest_nt_domain*",Authentication,Authentication</span></div>
<div class="p1">
<span class="s1">"*duration*",Authentication,Authentication</span></div>
<div class="p1">
<span class="s1">"*response_time*",Authentication,Authentication</span></div>
<div class="p1">
<span class="s1">src,Authentication,Authentication</span></div>
<div class="p1">
<span class="s1">"*src_nt_domain*",Authentication,Authentication</span></div>
<div class="p1">
<span class="s1">"*src_user*",Authentication,Authentication</span></div>
<div class="p1">
<span class="s1">"*user*",Authentication,Authentication</span></div>
<div class="p1">
<span class="s1">dest,Certificates,"All_Certificates"</span></div>
<div class="p1">
<span class="s1">"*dest_port*",Certificates,"All_Certificates"</span></div>
<div class="p1">
<span class="s1">"*duration*",Certificates,"All_Certificates"</span></div>
<div class="p1">
<span class="s1">"*response_time*",Certificates,"All_Certificates"</span></div>
<div class="p1">
<span class="s1">src,Certificates,"All_Certificates"</span></div>
<div class="p1">
<span class="s1">"*transport*",Certificates,"All_Certificates"</span></div>
<div class="p1">
<span class="s1">"*ssl_end_time*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_engine*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_hash*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_is_valid*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_issuer*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_issuer_common_name*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_issuer_email*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_issuer_locality*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_issuer_organization*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_issuer_state*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_issuer_street*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_issuer_unit*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_name*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_policies*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_publickey*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_publickey_algorithm*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_serial*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_session_id*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_signature_algorithm*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_start_time*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_subject*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_subject_common_name*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_subject_email*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_subject_locality*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_subject_state*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_subject_street*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_subject_unit*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_validity_window*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*ssl_version*",Certificates,SSL</span></div>
<div class="p1">
<span class="s1">"*delay*",Email,Email</span></div>
<div class="p1">
<span class="s1">dest,Email,Email</span></div>
<div class="p1">
<span class="s1">"*duration*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*file_hash*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*file_name*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*file_size*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*internal_message_id*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*message_id*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*message_info*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*orig_dest*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*orig_recipient*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*orig_src*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*process*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*process_id*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*protocol*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*recipient*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*recipient_count*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*recipient_status*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*response_time*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*retries*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*return_addr*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*size*",Email,Email</span></div>
<div class="p1">
<span class="s1">src,Email,Email</span></div>
<div class="p1">
<span class="s1">"*src_user*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*status_code*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*subject*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*url*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*user*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*xdelay*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*xref*",Email,Email</span></div>
<div class="p1">
<span class="s1">"*filter_action*",Email,Filtering</span></div>
<div class="p1">
<span class="s1">"*filter_score*",Email,Filtering</span></div>
<div class="p1">
<span class="s1">"*signature*",Email,Filtering</span></div>
<div class="p1">
<span class="s1">"*signature_extra*",Email,Filtering</span></div>
<div class="p1">
<span class="s1">"*signature_id*",Email,Filtering</span></div>
<div class="p1">
<span class="s1">dest,"Intrusion Detection","IDS_Attacks"</span></div>
<div class="p1">
<span class="s1">dvc,"Intrusion Detection","IDS_Attacks"</span></div>
<div class="p1">
<span class="s1">"*ids_type*","Intrusion Detection","IDS_Attacks"</span></div>
<div class="p1">
<span class="s1">"*severity*","Intrusion Detection","IDS_Attacks"</span></div>
<div class="p1">
<span class="s1">"*signature*","Intrusion Detection","IDS_Attacks"</span></div>
<div class="p1">
<span class="s1">src,"Intrusion Detection","IDS_Attacks"</span></div>
<div class="p1">
<span class="s1">"*user*","Intrusion Detection","IDS_Attacks"</span></div>
<div class="p1">
<span class="s1">"*date*",Malware,"Malware_Attacks"</span></div>
<div class="p1">
<span class="s1">dest,Malware,"Malware_Attacks"</span></div>
<div class="p1">
<span class="s1">"*dest_nt_domain*",Malware,"Malware_Attacks"</span></div>
<div class="p1">
<span class="s1">"*dest_requires_av*",Malware,"Malware_Attacks"</span></div>
<div class="p1">
<span class="s1">"*file_hash*",Malware,"Malware_Attacks"</span></div>
<div class="p1">
<span class="s1">"*file_name*",Malware,"Malware_Attacks"</span></div>
<div class="p1">
<span class="s1">"*file_path*",Malware,"Malware_Attacks"</span></div>
<div class="p1">
<span class="s1">"*signature*",Malware,"Malware_Attacks"</span></div>
<div class="p1">
<span class="s1">src,Malware,"Malware_Attacks"</span></div>
<div class="p1">
<span class="s1">"*user*",Malware,"Malware_Attacks"</span></div>
<div class="p1">
<span class="s1">"*vendor_product*",Malware,"Malware_Attacks"</span></div>
<div class="p1">
<span class="s1">dest,Malware,"Malware_Operations"</span></div>
<div class="p1">
<span class="s1">"*dest_nt_domain*",Malware,"Malware_Operations"</span></div>
<div class="p1">
<span class="s1">"*dest_requires_av*",Malware,"Malware_Operations"</span></div>
<div class="p1">
<span class="s1">"*product_version*",Malware,"Malware_Operations"</span></div>
<div class="p1">
<span class="s1">"*signature_version*",Malware,"Malware_Operations"</span></div>
<div class="p1">
<span class="s1">"*vendor_product*",Malware,"Malware_Operations"</span></div>
<div class="p1">
<span class="s1">dest,Performance,"All_Performance"</span></div>
<div class="p1">
<span class="s1">"*dest_should_timesync*",Performance,"All_Performance"</span></div>
<div class="p1">
<span class="s1">"*hypervisor_id*",Performance,"All_Performance"</span></div>
<div class="p1">
<span class="s1">"*resource_type*",Performance,"All_Performance"</span></div>
<div class="p1">
<span class="s1">"*cpu_load_mhz*",Performance,CPU</span></div>
<div class="p1">
<span class="s1">"*cpu_load_percent*",Performance,CPU</span></div>
<div class="p1">
<span class="s1">"*cpu_time*",Performance,CPU</span></div>
<div class="p1">
<span class="s1">"*cpu_user_percent*",Performance,CPU</span></div>
<div class="p1">
<span class="s1">"*fan_speed*",Performance,Facilities</span></div>
<div class="p1">
<span class="s1">"*power*",Performance,Facilities</span></div>
<div class="p1">
<span class="s1">"*temperature*",Performance,Facilities</span></div>
<div class="p1">
<span class="s1">"*mem*",Performance,Memory</span></div>
<div class="p1">
<span class="s1">"*mem_committed*",Performance,Memory</span></div>
<div class="p1">
<span class="s1">"*mem_free*",Performance,Memory</span></div>
<div class="p1">
<span class="s1">"*mem_used*",Performance,Memory</span></div>
<div class="p1">
<span class="s1">"*swap*",Performance,Memory</span></div>
<div class="p1">
<span class="s1">"*swap_free*",Performance,Memory</span></div>
<div class="p1">
<span class="s1">"*swap_used*",Performance,Memory</span></div>
<div class="p1">
<span class="s1">"*array*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*blocksize*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*cluster*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*fd_max*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*fd_used*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*latency*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*mount*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*parent*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*read_blocks*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*read_latency*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*read_ops*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*storage*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*storage_free*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*storage_free_percent*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*storage_used*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*storage_used_percent*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*write_blocks*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*write_latency*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*write_ops*",Performance,Storage</span></div>
<div class="p1">
<span class="s1">"*thruput*",Performance,Network</span></div>
<div class="p1">
<span class="s1">"*thruput_max*",Performance,Network</span></div>
<div class="p1">
<span class="s1">"*signature*",Performance,OS</span></div>
<div class="p1">
<span class="s1">
</span></div>
<div class="p1">
<span class="s1">"*uptime*",Performance,Uptime</span></div>
Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-57745966042450361732015-10-02T07:24:00.002-04:002023-01-24T11:52:47.015-05:00Taming Verbose Windows Logs - UpdateIn looking at the Windows firewall logs coming out of the Security event viewer (mainly 5156) I realized the space in "program files" was throwing off the regex. You got to love the format of Windows logs. Maybe one day we will ingest the XML version - not likely :(. If anyone has ideas on a better regex I am ALL EARS! I tried using newlines, carriage returns, spaces, etc in front of "Network" (which is 2 lines down from the application name) but wasn't getting the desired results.<br />
<br />
This is an update to ><a href="http://runals.blogspot.com/2014/07/taming-verbose-windows-logs-in-splunk.html" target="_blank">this</a>< post.<br />
<br />
Transforms<br />
New<br />
(?ms)EventCode=(5156|5152).*?Keywords=(Audit Failure|Audit Success).*?Message=The Windows Filtering Platform (?:has )?([^\.]+).*?Process ID:\s+(\S+).*?Application Name:\s+(<span style="background-color: yellow;">System|.+\.exe)</span>.*?Direction:\s+(\S+).*?Source Address:\s+(\S+).*?Source Port:\s+(\S+).*?Destination Address:\s+(\S+).*?Destination Port:\s+(\S+).*?Protocol:\s+(\S+).*?Filter Run-Time ID:\s+(\S+).*?Layer Name:\s+(\S+).*?Layer Run-Time ID:\s+(\S+)<br />
<br />
Old<br />
(?ms)EventCode=(5156|5152).*?Keywords=(Audit Failure|Audit Success).*?Message=The Windows Filtering Platform (?:has )?([^\.]+).*?Process ID:\s+(\S+).*?Application Name:\s+(<span style="background-color: cyan;">\S+</span>).*?Direction:\s+(\S+).*?Source Address:\s+(\S+).*?Source Port:\s+(\S+).*?Destination Address:\s+(\S+).*?Destination Port:\s+(\S+).*?Protocol:\s+(\S+).*?Filter Run-Time<br />
<br />
Props Field Extraction<br />
New<br />
^Trimmed Event EventCode=(?<EventCode>5152|5156) (?<Keywords>Audit Success|Audit Failure) (?<Process_ID>\S+) <span style="background-color: yellow;">(?<Application_Name>.+) (?<Direction>Outbound|Inbound) </span>(?<Source_Address>\S+) (?<Source_Port>\S+) (?<Destination_Address>\S+) (?<Destination_Port>\S+) (?<Protocol>\S+) (?<Filter_Run_Time_ID>\S+) (?<Layer_Name>\S+) (?<Layer_Run_Time_ID>\S+) (?<TaskCategory>blocked a packet|permitted a connection)<br />
<br />
Old<br />
^Trimmed Event EventCode=(?<EventCode>5152|5156) (?<Keywords>Audit Success|Audit Failure) <span style="background-color: cyan;">(?<Process_ID>\S+) (?<Application_Name>.+)</span> (?<Direction>\S+) (?<Source_Address>\S+) (?<Source_Port>\S+) (?<Destination_Address>\S+) (?<Destination_Port>\S+) (?<Protocol>\S+) (?<Filter_Run_Time_ID>\S+) (?<Layer_Name>\S+) (?<Layer_Run_Time_ID>\S+) (?<TaskCategory>blocked a packet|permitted a connection)Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-69679185123962008342015-08-04T10:10:00.002-04:002015-08-04T13:08:56.516-04:00Does better information sharing require a security clearance?From time to time the topic of information sharing comes up in relation to getting security clearances in order to have more open and timely dialog with various government agencies. Having lived in that space for a time I would agree having a clearance would help in having overarching conversations if only because the culture is one that defaults to needing a clearance to have meaningful dialog. The problem comes when I put on more of an incident responder/cyber defender hat. The TLDR summary is the information most useful to cyber defenders isn't who has compromised their environments as much as it is the IOCs and methodologies used to gain entry. This is because we aren't defending a strategic point in 3D space. We are having to defend our organizations potentially from every computer plugged into an ethernet jack or wifi around the planet. Note this post is about why I think having multiple people in your security group cleared is less important that an adjustment in the classification paradigm. This isn't in response to being notified that my company has been breached.<br />
<br />
Not to rehash 'cyber warfare' conversations post Aurora but conflict, by whatever definition, in the 5th domain (cyber) is unlike kinetic based conflict occurring especially in domains 1 through 3 (land, air, sea) and less so in space (the 4th). To back up a bit and make gross generalizations the end state of much of the classified intelligence space is ultimately linked to and focused on attribution (aka who's responsible for X so I can go punch them in the throat). Retribution though doesn't happen in the 5th domain - at least at the commercial level. The impasse generally found then is at the government information sharing level where the <i>who</i> is portion marked with the highest classification level because in that world that is the most important piece of information. That trickles down to portion marking the techniques being used and lastly things like specific things like IPs. While the initial response to a breach from management is often "who did this?" followed quickly by "why were we a target?" and the "why's" can and should help shape our defensive strategies/priorities, as a cyber defender at some level I could care less about the answers. Why you ask? Because that information isn't actionable. I'm more interested in the <i>how</i> as it relates to knowing what I should look for and what needs to be fixed. 'How' in this case ISN'T just which IP addresses were used 3 months ago and we are only hearing about this now. It is the full scope of IOCs.<br />
<br />
I fully appreciate if the federal agencies openly shared IOCs and TTPs the malicious actors would simply switch how they are doing what they are doing. That said though I don't believe the solution to more and better sharing at the rank and file actionable data level is to get a clearance so we can better operate in the federal space once we are 'read in'. For cyber based compromise notifications adjust the portion marking on the classified documents appropriately allowing companies to better defend and respond /shrug.Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-22070881378262826532015-06-29T23:28:00.001-04:002015-06-29T23:28:35.062-04:00Electronically Aided Collisions and InfoSecLike cruise control for your car, GPS assisted autopilots and the like for boats can help operators with mundane tasks like holding a course over a long stretch of water. Unlike driving though boating comes with additional challenges - keeping track of water depth, the impact of changing weather conditions, the fact that there generally aren't defined 'roads' or travel lanes, etc. The rise in adoption of electronic navigational devices has also seen a rise in what is being termed "Electronically Aided Collisions." These can range from a GPS device malfunction or signal interference which causes the boat to veer off course and run aground to a momentary (or longer term) judgement lapse where your attention is off where the boat is going and the general surroundings to the detriment of your boat - or worse - others.<br />
<br />
While my sail boating father and I were talking about this and him sharing stories my mind starting drawing parallels to the InfoSec world. I've tried to boil these down really to two thoughts<br />
<a name='more'></a><br />
<br />
<b>Who are the next generation of security engineers?</b><br />
We live in a world that is generating ridiculous amounts of machine data. We are compelled by audit and compliance regulations to configure our systems in a way that causes them to generate data at a very granular level, our operating environments are becoming more complex, and systems are becoming more interconnected (on prem, off prem, hybrid) which perhaps ironically can make understanding what is happening/has happened harder. While this isn't a bad thing it does require new approaches to capturing that data, parsing it, and making sense of it. There is certainly conversation where "doing more with less" in an environment that is generating exponentially 'more' could be had. That aside as we field the next generation of InfoSec professionals how do we train them to navigate the avalanche of data that necessitates the use of electronic tools in a way that let's them operate said tools and mentally reverse engineer what is happening in the environment that is generating the data in the first place?<br />
<br />
To turn that last sentence around some - people have been 'doing security' for years but most have come from various IT backgrounds and have fallen into security as it were. They are able to draw from their technical experience as they pursue a career track that has a security bent. It is a relatively new thing for the need to be understood and InfoSec treated as a profession, at scale, beyond simply something someone in the IT shop does. This has led and is leading to the development of Information Security degree tracks in higher ed and other security training programs in order to fill job position gaps. All good things(!) - but how do we develop security engineers (or an engineer mindset) based on how computing systems work and pragmatic experience instead of people who can just pass security tests?<br />
<br />
<b>Tool augmented security vs tool driven security vs lights out security</b><br />
Adding electronic tools to our utility belts is a good thing. Automation in general is a good thing! Both CAN allow someone or a team to do more than they otherwise could do manually be that triaging a system or interrogating gigabytes or terabytes of information for useful nuggets and taking action. Getting to the point where all of that happens automagically in a holistic way across a complex environment and in a way that ignores the human element though...? Similar to the GPS driven autopilot that works 99% of the time - except for when there is a few minute hiccup and you run aground - what happens when there is a change to the environment and your automated actions cause an issue. Anyone running a fully automated IPS? An over-reliance on security devices to take automated actions can and will have an impact at some point which might end up impacting the security program negatively for a longer period than the actual outage.<br />
<br />
In summary I wonder at the convergence of both issues. We end up with what I might call Electronically Aided Blindspots. These blindspots can occur on two fronts. The first is missing segments of data flowing into your electronic tools that you either aren't aware of because of environmental complexities or because the data isn't available (ie many cloud vendors). The second is reliance on said tools to the point where you trust them more than your eyes/experience/common sense. The classic case is how many times have you had system admins/system owners say even though a system exhibited anomalies it can't be infected by malware or otherwise pwned because the local AV software isn't triggering on anything? Of course the worse scenario on this front is when your security tool operator lacks the ability to interpret the data the thing IS generating and is unable to make a decision or tune the thing.<br />
<br />
So do you have any EABs and which is overshadowing your visibility - the data (not) flowing into your security devices, an over reliance on your tools, or the tool operators?Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-31856021390582219392015-02-07T16:48:00.003-05:002015-02-07T16:52:31.297-05:00Gaining visibiliy to ad-hoc data exports from Splunk<span style="font-family: Times, Times New Roman, serif;">Along the same lines of understanding how your users are using Splunk and dovetailing into are users abusing their access to data in Splunk is taking a periodic look into what data they might be exporting. By that I mean exporting to a csv or maybe generating a pdf of a dashboard. Ideally you would like to know, for example, if this Mark character has exported something, what format was it in, what was the search, and how many records or results were included in the download.<br />There are a couple challenges</span><br />
<span style="font-family: Times, 'Times New Roman', serif;"></span><br />
<ol><span style="font-family: Times, 'Times New Roman', serif;">
<li>Search results (result count, events searched, etc) are in the internal search completion logs while the search parameters are in the internal search initiation logs.</li>
<li>Those logs are separate from the web logs that indicate someone has performed one of the export actions.</li>
<li>The various Splunk commands you might use to merge all of this data has some limitations that you will need to keep in mind. For example to use a subsearch to get something like search_id and pass it to a parent search is limited by default to a 60s runtime and/or 10k results. A join or append is limited to a 60s runtime and/or 50k records, again by default. If you have even a moderately sized deployment over the course of several days you have thousands of searches being run when you factor in your users, scheduled content, and internal Splunk processes. I suppose one way to mitigate this is to review the detection query output every day but that seems a little too frequent to me.</li>
</span></ol>
<span style="font-family: Times, 'Times New Roman', serif;">
</span><br />
<ol>
</ol>
<ol>
</ol>
<ol>
</ol>
<a name='more'></a><span style="font-family: Times, Times New Roman, serif;">Let's break the first two items down. To collapse searches relative to item 1 you could perform a search like this</span><br />
<span style="font-family: Times, Times New Roman, serif;"><br /><span style="color: blue;">index=_audit "action=search" "info=granted" OR "info=completed" | table apiStartTime apiEndTime user search_id result_count user search | stats values(*) as * by search_id</span></span><br />
<span style="font-family: Times, Times New Roman, serif;"><span style="color: blue;"><br /></span></span>
<span style="font-family: Times, 'Times New Roman', serif;">The linking factor between is the search_id so that is the obvious split-by field. The values(*) bit is just a fancy shortcut that allows you to get the values from the other fields without having to write them all out. It is helpful if you want to add an additional field like event_count or scan_count. Note that one reason we are able to get away with this is each of the fields in question only has one piece of data. If there were multiple pieces you could still do the values(*) but you might need to use a mvexpand into your query.</span><br />
<span style="font-family: Times, Times New Roman, serif;"><br />The next piece is to figure out the web logs for things like ad-hoc pdf export or csv. Through some trial and error I came up with the following indicators in Splunk's web logs. For example this first one is showing me having Splunk export a dashboard to PDF</span><br />
<span style="font-family: Times, Times New Roman, serif;"><br /><span style="background-color: white; color: #333333; font-size: x-small; line-height: 16px; white-space: pre-wrap;">10.10.10.1 - runals [05/Feb/2015:07:29:32.127 -0500] "POST /splunk/web/en-US/splunkd/__raw/services/pdfgen/render HTTP/1.1" 200 95604 "https://splunk:443/splunk/web/en-US/app/CTCM/ct_change_overview?earliest=0&latest=" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.94 Safari/537.36" - 54d3622c207f538c367c10 24135ms</span></span><br />
<span style="font-family: Times, Times New Roman, serif;"><span style="background-color: white; color: #333333; line-height: 16px; white-space: pre-wrap;"><br /></span><span style="background-color: white; color: #333333; line-height: 16px; white-space: pre-wrap;">This second one is me having Splunk export one of the dashboard panels as a csv</span></span><br />
<span style="font-family: Times, Times New Roman, serif;"><span style="background-color: white; color: #333333; line-height: 16px; white-space: pre-wrap;"><br /></span><span style="background-color: white; color: #333333; font-size: x-small; line-height: 16px; white-space: pre-wrap;">10.10.10.1 - runals [05/Feb/2015:07:34:21.046 -0500] "GET /splunk/web/en-US/api/search/jobs/runals__runals__CTCM__search2_1423139369.829/results?isDownload=true&timeFormat=%25FT%25T.%25Q%25%3Az&maxLines=0&count=0&filename=testtesttest&outputMode=csv&spl_ctrl-limit=unlimited&spl_ctrl-count=1000 HTTP/1.1" 200 - "https://splunk:443/splunk/web/en-US/app/CTCM/ct_change_overview?earliest=0&latest=" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.94 Safari/537.36" - 54d3634d0b7f53a05cecd0 88ms</span></span><br />
<span style="font-family: Times, Times New Roman, serif;"><span style="background-color: white; color: #333333; line-height: 16px; white-space: pre-wrap;"><br /></span>So there are a couple things to note. The first is both have the app context and dashboard the user is in (even if just in "search" which isn't represented here). The second is only the csv export has a search_id. The query I used then is as follows. </span><br />
<span style="font-family: Times, Times New Roman, serif;"><br /><span style="color: blue;">index=_internal sourcetype=splunk_web_access isDownload=true OR uri=*/render | rex "/app/(?<app>[^/]+)/(?<dashboard>[^\?\"]+)" | rex "jobs/(?<search_id>[^\/]+)" | eval outputMode= if(isnotnull(outputMode), outputMode, "pdf of dashboard") | eval filename = if(isnull(filename) AND NOT like(outputMode,"pdf%"), search_id, filename) | table _time host user search_id outputMode filename app dashboard</span></span><br />
<span style="font-family: Times, Times New Roman, serif;"><span style="color: blue;"><br /></span>In order to stitch this together I'm first going get the search_ids for the csv etc exported data in a subsearch to pass to get the search particulars. Then run an append to get the user, app context, and export types. You could use a join here but the PDFs aren't going to have a search_id. This was the first time using random() which was cool for me.</span><br />
<span style="font-family: Times, Times New Roman, serif;"><br /><span style="color: blue;">index=_audit "action=search" "info=granted" OR "info=completed" [search index=_internal sourcetype=splunk_web_access isDownload=true | rex field=uri "jobs\/(?<search_id>[^\/]+)" | eval search_id = "'".search_id."'" | fields search_id] | table apiStartTime apiEndTime user search_id result_count user search | stats values(*) as * by search_id | rex field=search_id "'(?<search_id>[^']+)" | append [search index=_internal sourcetype=splunk_web_access isDownload=true OR uri=*/render | rex "/app/(?<app>[^/]+)/(?<dashboard>[^\?\"]+)" | rex "jobs/(?<search_id>[^\/]+)" | eval outputMode= if(isnotnull(outputMode), outputMode, "pdf") | eval filename = if(isnull(filename) AND NOT like(outputMode,"pdf%"), search_id, filename) | table _time host user search_id outputMode app dashboard filename] | eval search_id = if(isnotnull(search_id), search_id, "-".random()) | rename _time as time | stats values(*) as * by search_id | table time user host app dashboard outputMode filename result_count apiStartTime apiEndTime search | sort time | convert ctime(time) | rename apiStartTime as query_start apiEndTime as query_end | eval filename = urldecode(filename)</span></span><br />
<span style="font-family: Times, Times New Roman, serif;"><span style="color: blue;"><br /></span>Of course in talking with one of our student workers we did come up with another use case to cover. What if someone used a command like outputlookup to write data to a local csv. There are a couple issues with this. The first is someone would have to have access to the server to actually grab the file; the second is this is a common way to generate dynamically updated lookups. I've gone ahead and baked this in but is sort of kludgy and I don't want to go through the process of linking these to the Splunk web logs or including searches that are scheduled. Again the point of this exercise is to look at the ad-hoc stuffs. To assuage my guilt at not getting the app/dashboard context I've put in the search id in the dashboard field allowing someone to look it up if they so desire.</span><br />
<span style="font-family: Times, Times New Roman, serif;"><br /><span style="color: blue;">index=_audit "action=search" "info=granted" OR "info=completed" [search index=_internal sourcetype=splunk_web_access isDownload=true | rex field=uri "jobs\/(?<search_id>[^\/]+)" | eval search_id = "'".search_id."'" | fields search_id] | table apiStartTime apiEndTime user search_id result_count user search | stats values(*) as * by search_id | rex field=search_id "'(?<search_id>[^']+)" | append [search index=_internal sourcetype=splunk_web_access isDownload=true OR uri=*/render | rex "/app/(?<app>[^/]+)/(?<dashboard>[^\?\"]+)" | rex "jobs/(?<search_id>[^\/]+)" | eval outputMode= if(isnotnull(outputMode), outputMode, "pdf") | eval filename = if(isnull(filename) AND NOT like(outputMode,"pdf%"), search_id, filename) | table _time host user search_id outputMode app dashboard filename] | append [search index=_audit "action=search" "info=granted" OR "info=completed" [search index=_audit "action=search" "info=granted" OR "info=completed" outputlookup OR outputcsv OR outputtext NOT "outputlookup OR outputcsv OR outputtext" savedsearch_name="" | fields search_id] | rename _time as time | table time apiStartTime apiEndTime user search_id result_count user search host | stats values(*) as * by search_id | rex field=search "(?<outputMode>output(lookup|csv|text))\s+(?<filename>\S+)" | eval app = "search_id =" | eval dashboard = search_id | stats min(time) as time1 by outputMode host search_id apiEndTime apiStartTime filename result_count search user app dashboard]| eval search_id = if(isnotnull(search_id), search_id, "-".random()) | eval time = coalesce(time1,_time) | fields - time1 _time | stats values(*) as * by search_id | table time user host app dashboard outputMode filename result_count apiStartTime apiEndTime search | sort time | convert ctime(time) | rename apiStartTime as query_start apiEndTime as query_end | eval filename = urldecode(filename) </span></span><br />
<span style="font-family: Times, Times New Roman, serif;"><span style="color: blue;"><br /></span> In my decently large environment the query takes all of about 15 seconds to run over a 7 day period.</span>Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-7108731094637992732015-01-31T09:43:00.000-05:002015-01-31T09:43:21.878-05:00Splunk Apps: Forwarder HealthIt is long past time I actually wrote a few posts on the Splunk apps I've created. Woke up far too early for a Saturday morning and in an effort to avoid anything around the house I will rationalize this as productivity at a general level and feel I've accomplished much! Who knows - it might be of value to my ... ones ... of readers! =)<br />
<br />
Actually it was VERY cool to have a guy come up after my presentation at the 2014 Splunk user conference and mention having read my blog while working with ArcSight and now while working with Splunk (thanks Joe!).<br />
<br />
Forwarder Health<br />
<br />
So our environment has currently some 2,200+ forwarders which is certainly not the largest environment out there but is likely much larger than the average. While there are apps like Splunk on Splunk and Fire Brigade to help identify issues with your indexers and search heads there wasn't something that helps identify issues with forwarders. Admittedly this is a hefty task as there are innumerable issues a forwarder can have. I wondered though if there was a way to generically detect if an agent was having issues. The sage like advice from the Verizon breach reports bubbled up in my mind - start by looking at the size of the haystacks. What if you were to compare the number of internal logs a forwarder was generating and compare it to the average? A couple hours later the bones of the app were in place.<br />
<br />
<a name='more'></a><br />
When you first install the app you should go to the macro section and adjust the macros for your search head and indexer naming convention. As the app's name implies this is about forwarders and the logs from your sh/idx tier are very verbose. While you are there the other macro to look at is what the rest of the searches are NOT looking for in the internal logs - basically that the agent is sending logs to the indexing tier. If you want to adjust those searches to not look at other types of logs this is the place.<br />
<br />
Having already created the Data Curator app with its scoring system for your props configs and field extraction % I wanted to come up with one for your agent health. What I came up with was pretty simplistic and might need a revisit. All agents start with a score of 10 and is reduced by 1 for each factor their logs are over the average. In other words if a forwarder is generating 6x the average logs its score would be 4. In looking at my environment's score with my 2,240 forwarders I have a 9.8. There are 1871 with a score of 10 and another 100 with a score of 9. There are 24 with a score of 0 so while the scoring methodology is simplistic and not overly telling at this scale I suppose it does show that it isn't likely most of your forwarders have issues. 24 of 2,240 is right at 1%. The first dashboard you will probably look at is the Internal Event Count Overview. Here is the top portion of mine.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZM0NPVPCK1Aw421uMVOD-MT9dqlSRYfZppIPHZS-ze-rV-W5OcgMIJTIRZSTxxq9xbSoQNt0s55-5NLQNcep6PuSgn3vka8wKfz0K8SYQRZex07TFJFIW6nqdyF3EXzmma7uSn0aEz3qq/s1600/fh_overview.tiff" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZM0NPVPCK1Aw421uMVOD-MT9dqlSRYfZppIPHZS-ze-rV-W5OcgMIJTIRZSTxxq9xbSoQNt0s55-5NLQNcep6PuSgn3vka8wKfz0K8SYQRZex07TFJFIW6nqdyF3EXzmma7uSn0aEz3qq/s1600/fh_overview.tiff" height="251" width="640" /></a></div>
<br />
The heart of the queries is<br />
<br />
<span style="color: blue;">index=_internal NOT `splunk_indexers` NOT `splunk_search_heads` `agent_internal_logs_blacklist` | stats count as events by host | eventstats avg(events) as avg_events | eval avg_count = floor(events/avg_events) | eval agent_score = 10 - avg_count | eval agent_score = if(agent_score<0, 0, agent_score)</span><br />
<br />
The last pipe there is to account for those systems that are generating a metric ton of events as noted by the dashboard panel in the bottom right of the screenshot above. Good thing internally generated Splunk logs don't count against your license! The bottom panel of the dashboard (not shown) will let you know which systems are your trouble children and clicking on one of them will actually open up the next dashboard: Internal Logs - Host View.<br />
<br />
This dashboard shows a number of things but in order to not have to account for every possible issue I figured it would be best to cluster the internal logs. Note the cluster command works differently than simple stats count or even stats count by punct (field) of the internal logs. While it isn't documented particularly well in terms of the methodology used the cluster command will group similar events. So while you might have multiple events saying the forwarder can't read individual files, with an event per file attempting to be read, the cluster command should give you an overall count of those events. In the case of the forwarder generating over 400k events the vast majority are of the "INFO WatchedFile - Will begin reading at offset" variety. However that is a symptom of the real issue which shows up on the next 2 lines which is there are a number of very small files that the agent is having trouble reading so simply ingests the file again.<br />
<br />
The next highly usable dashboard is Limits and Path Monitoring issues. At a base level I believe detecting when an agent is struggling to keep up with the data it is being asked to read in and forward is a big deal and one that is a pretty easy win (for these 2 issues assuming the system and network resources can accommodate changes). For example the other day we installed a second forwarder on one of our syslog receiving servers for Splunk and didn't adjust the file descriptor limits. In a 24hr period there were thousands of messages indicating the default 100 simply wasn't enough. We also have a job that runs once a day to show us forwarder limits issues so I created these as saved searches vs inline panels on the dashboard which makes it easy for you all to do the same if you are so inclined.<br />
<br />
The Forwarder Version Distribution is a very cool dashboard I think in that it shows you lots of information in a small space. The top of ours at the moment looks like this<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjYeRTjgW-SjuW9p-075xNB5FyOREn1yzQp5yr4ypXDSfh2_bx7h_4duhfO2knrri33y5fP7CGw8iTZcLCYUFj5NosX9wFsEgYddWLCJ8tcyOZpQok8qm-UQ_RmDCybzG_coCXGM33RAnGx/s1600/fh_fwds.tiff" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjYeRTjgW-SjuW9p-075xNB5FyOREn1yzQp5yr4ypXDSfh2_bx7h_4duhfO2knrri33y5fP7CGw8iTZcLCYUFj5NosX9wFsEgYddWLCJ8tcyOZpQok8qm-UQ_RmDCybzG_coCXGM33RAnGx/s1600/fh_fwds.tiff" height="154" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
The other panels show you the volume of logs from the different versions which is useful for a number of things. Part of this dashboard was born out of rediscovering the bug with agents under 5.0.4 which can send almost 2x logs to the first indexer on our output.conf list than the other indexers on your list. Now if I can just get a couple large groups to update their old agents! </div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
The last dashboard I'll briefly mention is the deployment server clientName string one. I debated putting this here but we use the clientName string on all of our forwarder agents and there really aren't visualizations in other Splunk provided content/apps (that I know of). If the strings are missing or whacked there are issues. Hopefully this isn't too catered to our environment. If you aren't familiar with using the clientName string it is placed in the forwarders deploymentclient.conf file and can be used as part of the whitelist/blacklist components of your Splunk Deployment Server serverclass.conf file. </div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
Welp - somewhat long winded. I'm very open to feedback on the app. Are there things that should be added or tweaked?</div>
Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com2tag:blogger.com,1999:blog-5581836178306074825.post-17206061293756494942014-12-17T09:58:00.003-05:002014-12-17T09:59:52.902-05:00Greatest Splunk search of all timeOf all of the Splunk searches I've made over the last couple years the one I keep coming back to time after time is this<br />
<br />
<span style="color: blue;">index=_internal sourcetype=splunkd deployedapplication (removing OR installing OR uninstalling) NOT "removing app at location" | rex "DeployedApplication - (?<Action>\S+)\sapp(\=|\S+\s)(?<App>\S+)" | eval Action = case(Action="Removing" , "Removing" , Action="Uninstalling" , "Removing" , Action="Installing" , "Installing" , 1=1,"Fix me") | rex "(Removing|Installing) app=(?<Version>\S+)" | eval Version = if(isnull(Version),"5x","-= 6x =-") | dedup _time host Action App Version | table _time host Action App Version | sort -_time</span><br />
<br />
This search shows apps being installed or removed at agent level and is invaluable from an admin perspective. I have it saved to run in 5 minute real-time which is a good window for us as our agents only check into our deployment server every 3 minutes.Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-37856572825865573752014-07-16T09:12:00.002-04:002014-07-16T09:19:28.248-04:00So how big ARE Windows Logs?<br />
In my <a href="http://runals.blogspot.com/2014/07/taming-verbose-windows-logs-in-splunk.html" target="_blank">last post</a> I mentioned how I was re-writing a few Windows events to cut down on Splunk license issues. In trying to size log management solutions in the past I've looked for lists or rules of thumb when it comes to the size of Windows events but never really found anything. That being the case hopefully someone will find this useful. I ran a query just now in Splunk to get the average byte count per Windows event ID. If you need to figure out log management license sorts of things this could give you a ROM by which to multiply a sampling of your event count against (as in number of logs on one server over 24hrs * number of related servers). After the cut you will find a 'csv' listing the Event Viewer (sourcetype), Event ID (EventCode), and average bytes for that ID. Enjoy. Oh - the average byte count for all of our Windows logs is 630.<br />
<div>
<a name='more'></a><br /></div>
<div>
sourcetype,EventCode,avg_bytes</div>
<div>
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse; width: 65px;">
<!--StartFragment-->
<colgroup><col style="width: 65pt;" width="65"></col>
</colgroup><tbody>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt; width: 65pt;" width="65">WinEventLog:Application,0,422</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1,498</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,1,403</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1,405</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2,297</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,2,331</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,3,828</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,3,392</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4,325</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,4,433</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5,817</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,5,290</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6,470</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,6,392</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,7,716</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Setup,7,399</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:setup,7,406</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8,523</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,8,654</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Setup,9,365</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,9,275</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:setup,9,372</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,10,483</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,10,505</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,11,460</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,11,353</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,12,313</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,13,532</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,13,334</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,14,649</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,15,419</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,16,532</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,16,403</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,17,962</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,18,463</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,19,435</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,19,486</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,20,312</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,20,365</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,22,2278</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,24,615</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,26,366</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,27,401</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,29,605</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,32,402</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,34,353</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,35,425</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,36,551</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,37,433</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,42,310</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,46,341</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,50,394</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,53,293</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,55,599</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,56,363</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,57,542</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,58,288</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,63,546</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,64,405</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,65,433</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,66,436</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,67,321</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,77,471</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,78,324</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,79,326</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,98,372</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,100,493</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,100,278</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,101,557</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,101,412</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,102,315</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,103,447</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,103,422</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,104,388</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,104,279</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,105,947</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,107,312</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,108,550</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,109,305</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,111,302</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,112,289</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,114,326</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,117,246</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,119,428</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,121,369</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,129,516</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,131,379</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,135,228</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,139,347</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,142,387</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,145,218</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,146,406</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,146,410</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,148,519</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,151,520</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,152,524</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,155,550</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,157,249</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,158,263</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,164,380</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,200,299</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,208,536</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,216,401</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,256,350</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,258,329</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,262,324</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,266,300</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,267,310</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,272,278</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,274,283</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,275,292</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,282,291</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,300,301</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,301,372</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,302,314</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,325,448</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,326,548</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,327,550</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,333,373</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,334,452</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,401,276</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,452,311</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,453,311</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,482,692</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,489,600</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,500,350</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,500,341</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,501,446</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,508,333</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,510,465</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,513,441</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,515,432</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,516,399</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,528,710</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,529,662</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,531,683</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,535,683</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,537,672</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,538,393</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,539,664</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,540,727</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,551,381</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,552,777</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,560,993</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,562,413</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,563,661</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,564,384</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,566,816</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,567,531</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,576,612</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,577,615</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,578,651</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,592,488</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,593,448</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,600,719</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,605,432</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,653,286</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,654,284</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,656,688</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,657,650</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,672,666</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,673,492</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,675,449</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,680,406</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,682,454</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,683,456</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,697,508</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,700,469</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Directory Service,700,348</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,701,470</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Directory Service,701,557</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,753,350</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,754,335</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,800,299</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,801,387</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,861,606</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,900,312</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,902,310</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,903,294</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,906,604</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,912,662</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,958,371</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1000,446</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1000,421</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1001,900</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1001,442</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1002,5115</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1003,1352</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1005,362</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1006,382</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1006,534</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1007,336</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1008,3738</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1011,396</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1013,394</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1014,455</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1014,406</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1015,839</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1016,789</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1020,314</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1022,510</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1025,494</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1026,1544</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1029,504</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1030,446</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1030,751</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1031,390</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1033,570</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1034,370</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1035,524</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1036,558</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1038,536</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1039,983</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1040,544</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1041,319</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1042,379</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1044,335</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1050,551</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1053,450</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1058,942</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1063,329</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1066,1019</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1074,602</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1085,457</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,1100,304</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1103,501</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,1105,404</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1106,595</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1111,435</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1112,618</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1116,1055</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1119,491</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1130,345</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1150,398</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1174,314</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1196,603</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1202,2208</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1213,419</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1305,887</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1306,1853</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1309,3804</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1314,1268</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1315,1293</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1316,6288</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1344,725</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1376,339</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1485,323</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1500,437</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1502,416</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1503,453</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1509,339</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1511,498</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1512,585</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1517,780</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1525,481</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1530,952</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1531,346</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1532,333</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1538,432</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1578,819</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,1579,726</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,1704,304</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,2000,547</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2001,353</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,2001,815</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,2002,442</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2003,317</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2004,431</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,2004,683</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2005,317</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2006,298</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2011,410</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2012,417</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,2013,280</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2034,394</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2070,974</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2080,865</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2095,403</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2100,609</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2105,508</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2106,525</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2137,876</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2138,979</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2159,463</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2283,516</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2330,528</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2391,359</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2501,485</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2601,673</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2604,636</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2803,458</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,2803,458</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,2915,520</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,3004,551</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,3402,378</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,3402,378</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,3406,378</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,3407,375</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,3408,344</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,3409,285</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,3454,393</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,3454,404</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,3455,414</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,3563,303</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,3570,325</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4001,2827</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4002,422</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4004,332</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4097,455</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4098,553</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4101,273</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,4102,315</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,4105,1103</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4111,346</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4112,342</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4114,9112</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4140,871</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,4200,404</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,4201,362</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4202,811</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,4227,769</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,4319,425</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4400,497</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,4400,322</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4608,393</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4610,2572</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4611,596</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4616,917</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4624,990</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4625,530</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4625,1090</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4626,543</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4634,656</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4647,561</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4648,1185</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4656,949</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4657,933</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4659,879</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4660,622</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4661,1538</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4662,901</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4663,827</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4664,621</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4665,574</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4666,757</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4667,541</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4670,828</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4672,675</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4673,717</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4674,965</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4675,678</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4688,1713</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4689,550</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4690,627</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4692,627</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4696,789</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4698,2176</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4699,2174</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4700,2248</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4700,2855</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4701,2857</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4702,2774</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4717,583</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4718,585</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4720,1201</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4722,567</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4723,602</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4724,595</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4725,560</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4727,695</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4728,817</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4729,749</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4731,718</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4732,670</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4733,674</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4734,637</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4735,677</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4737,708</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4738,1059</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4740,603</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4741,1199</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4742,1163</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4755,708</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4756,850</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4767,551</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4768,1103</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4769,813</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4770,763</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4771,1125</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4774,434</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4776,508</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4778,732</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4779,745</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4780,1219</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4781,640</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4793,610</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4800,461</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4801,465</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4879,382</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4886,479</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4887,600</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4902,368</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4904,628</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4905,628</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4907,952</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4912,1415</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4931,698</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4932,733</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4933,748</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4946,516</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4948,520</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4954,377</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4956,378</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4957,507</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4965,1094</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,4985,696</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,4999,510</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5000,322</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,5000,279</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5001,300</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5002,301</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5003,478</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5007,341</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5013,1425</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5024,327</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5026,714</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5031,471</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5033,326</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,5050,285</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5056,467</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5058,880</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5061,706</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,5074,424</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5084,341</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,5084,364</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5136,975</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5137,836</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5140,699</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5141,897</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5143,896</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5145,1051</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5154,730</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5157,737</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5158,692</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,5186,482</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5197,385</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5447,1935</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5449,805</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5451,1160</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,5463,385</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5551,632</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5553,697</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5555,3567</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5586,603</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5604,379</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5605,560</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5611,413</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5615,341</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,5617,357</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,5719,905</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,5722,440</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,5723,1561</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,5779,410</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,5782,403</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,5805,375</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,5807,1726</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,5810,2234</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6003,357</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,6005,260</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,6006,260</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,6009,284</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6012,421</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,6013,258</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6019,381</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,6037,542</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,6038,878</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6126,672</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,6144,560</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,6145,545</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6207,1199</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,6272,1424</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,6273,1523</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,6278,1476</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,6281,590</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,6290,279</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,6299,358</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6398,1163</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6482,1405</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6701,390</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6702,372</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6704,436</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6705,438</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6808,667</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6812,651</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6814,1022</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6815,680</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6816,747</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6817,665</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,6818,685</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,7000,323</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,7001,355</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,7001,371</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,7002,344</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,7003,325</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,7006,332</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,7024,415</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,7026,398</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,7031,400</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,7034,297</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:ForwardedEvents,7035,388</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,7035,322</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:ForwardedEvents,7036,341</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,7036,384</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:ForwardedEvents,7040,411</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,7040,466</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,7042,553</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,7045,605</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,7078,1392</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,7079,322</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,7403,493</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,7493,733</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,7557,845</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,7701,486</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,8003,437</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,8019,1392</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,8021,655</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,8032,355</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8088,395</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8090,407</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8128,516</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8194,458</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8197,495</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8210,491</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8215,409</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8217,385</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,8222,896</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8224,281</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8225,347</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8227,333</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8230,739</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8245,391</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8280,386</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8306,839</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8312,898</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8528,603</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8560,444</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,8561,452</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,9002,386</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9003,330</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9009,301</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9010,524</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,9014,312</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9017,447</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9018,718</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9025,466</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9214,347</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9217,456</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9235,305</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9646,459</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9661,330</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9666,324</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9688,291</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9692,359</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9826,688</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9875,518</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,9877,439</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,10000,555</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,10001,366</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,10004,375</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,10005,334</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,10009,354</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,10010,416</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,10010,432</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,10012,535</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,10016,766</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,10024,512</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,10025,594</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,10028,502</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,10148,467</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,10149,493</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,10311,315</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,11006,2823</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,11160,1239</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,11166,1300</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,11707,364</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,11724,347</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,11728,407</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,12014,471</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,12015,468</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,12017,376</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,12018,476</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,12288,373</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,12289,372</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,12293,431</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,12294,589</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,12321,294</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,12325,391</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,12339,625</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,12344,446</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,12503,299</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,12517,268</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,13051,308</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,14554,356</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,15021,372</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,15223,312</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,15268,286</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,15268,262</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,16022,364</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,16240,344</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,16241,389</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,16384,359</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,16391,519</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,17051,268</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17055,321</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17069,451</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,17069,437</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17101,288</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,17101,259</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17103,277</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,17103,253</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17104,283</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,17104,259</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17110,285</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,17110,540</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17111,360</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,17111,348</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17115,289</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,17115,285</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17125,433</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17126,366</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17136,282</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17137,327</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,17137,330</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17162,376</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17164,335</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17166,404</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17176,452</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17201,344</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,17401,401</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17573,404</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,17573,365</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17663,369</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,17836,416</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,17890,451</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,18265,665</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,18265,637</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,18268,584</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,18268,584</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,18270,715</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,18453,408</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,18453,418</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,18454,375</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,18454,371</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,18456,433</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,18456,402</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,18496,285</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,19030,298</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,20000,349</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,20001,481</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,20003,449</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,20097,348</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,20102,2244</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,20154,314</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,20209,554</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,20250,383</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,20266,447</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,20272,641</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,20274,380</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,20275,342</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,20400,641</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,20517,592</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,20530,364</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,26018,325</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,26022,303</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,26023,340</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,26048,362</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Security,26401,519</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,28005,423</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,31003,866</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,31314,598</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,32092,369</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,33205,1426</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,36870,433</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,36874,470</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,36882,537</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,36885,755</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,36886,603</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,36887,299</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,36888,337</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,40960,534</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,40961,353</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,41015,279</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,45058,380</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application:MSSQLServer,49904,337</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,50008,642</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,50009,642</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,50036,345</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,50037,370</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,50079,306</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,51046,347</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:System,51047,372</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,58100,607</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,58101,624</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,58105,693</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,58107,661</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,63105,492</td>
</tr>
<tr height="15" style="height: 15.0pt;">
<td height="15" style="height: 15.0pt;">WinEventLog:Application,63109,346</td>
</tr>
<!--EndFragment-->
</tbody></table>
</div>
Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-31530943365306466212014-07-16T08:40:00.000-04:002015-10-02T09:24:46.066-04:00Taming verbose Windows logs in SplunkAs you get into the world of logs you quickly realize how 'heavy' Windows logs are. By that I mean verbose. In this space verbose = length and log length translates to increased storage and licensing issues. Many log generators simply say this did that or this talked to that over this port. Pretty quick and dirty. Windows logs are generally along the lines of "dear reader, I've observed many events in the course of my life and here is something I thought I should bring to your attention. I will go on at length about this though really only give small pieces of important information with little to no explanation forcing you to scour the Internet looking for others who have gone through this self same issue." I ran a quick search in my Splunk environment and found the average Windows event code to be 630 bytes.<br />
<br />
<a name='more'></a><br />
So what to do about this and why am I posting? There is a group sending logs here ... how shall I say this... that gave me the opportunity to explore creative ways to adjust logs coming into Splunk. Folks let me just say turning on object access in Windows can be a a great and appropriate thing to do. However, this is not something you want to do across the board or just willy-nilly as they say. We were getting millions of logs relating back to object auditing, specifically close events (4658). I will say with a Splunk 6.x agent you can blacklist entire events but I was more inspired by something Adrian Hall had posted <a href="http://blogs.splunk.com/2012/09/21/the-splunk-app-for-active-directory-and-how-i-tamed-the-security-log/" target="_blank">here</a>. Since these particular logs really only contain 2 pieces of more critical data in the end what I ended up doing was re-writing the event! To do so add the following lines as appropriate<br />
<br />
--- Props.conf ---<br />
<br />
[WinEventLog:Security]<br />
TRANSFORMS-winsec_events_manipulation = replace4658<br />
EXTRACT-winsec_4658_custom_fields = ^Trimmed Event EventCode=(?<EventCode>4658) Handle_ID=(?<Handle_ID>\S+) Process_ID=(?<Process_ID>\S+)<br />
<br />
---- Transforms.conf ---<br />
<br />
[replace4658]<br />
REGEX = (?ms)EventCode=(4658).*?Handle ID:\s+(\S+).*?Process ID:\s+(\S+)<br />
DEST_KEY = _raw<br />
FORMAT = Trimmed Event EventCode=$1 Handle_ID=$2 Process_ID=$3<br />
<br />
You wouldn't believe the difference from a license volume perspective that made. With that done I took a look at other events I could re-write. Based on things like size and volume I turned my attention to the Windows Filtering Platform. These are logs I have mixed emotions about. They are good to have but often you will have scads and scads of them for the same crap over and over. In particular I tackled 5152 and 5156 (blocked a packet and allowed a connection respectively). Since we already have an appropriate stanza in props I'll just add a bit to the TRANSFORMS line and add a stanza to the actual transforms.conf<br />
<br />
--- Props.conf ---<br />
<br />
[WinEventLog:Security]<br />
TRANSFORMS-winsec_events_manipulation = replace4658,replace5152_5156<br />
EXTRACT-winsec_4658_custom_fields = ^Trimmed Event EventCode=(?<EventCode>4658) Handle_ID=(?<Handle_ID>\S+) Process_ID=(?<Process_ID>\S+)<br />
EXTRACT-winsec_5152_5156_custom_fields = ^Trimmed Event EventCode=(?<EventCode>5152|5156) (?<Keywords>Audit Success|Audit Failure) (?<Process_ID>\S+) (?<Application_Name>.+) (?<Direction>Outbound|Inbound) (?<Source_Address>\S+) (?<Source_Port>\S+) (?<Destination_Address>\S+) (?<Destination_Port>\S+) (?<Protocol>\S+) (?<Filter_Run_Time_ID>\S+) (?<Layer_Name>\S+) (?<Layer_Run_Time_ID>\S+) (?<TaskCategory>blocked a packet|permitted a connection)<br />
<br />
---- Transforms.conf ---<br />
<br />
[replace4658]<br />
REGEX = (?ms)EventCode=(4658).*?Handle ID:\s+(\S+).*?Process ID:\s+(\S+)<br />
DEST_KEY = _raw<br />
FORMAT = Trimmed Event EventCode=$1 Handle_ID=$2 Process_ID=$3<br />
<br />
[replace5152_5156]<br />
REGEX = (?ms)EventCode=(5156|5152).*?Keywords=(Audit Failure|Audit Success).*?Message=The Windows Filtering Platform (?:has )?([^\.]+).*?Process ID:\s+(\S+).*?Application Name:\s+(System|.+\.exe).*?Direction:\s+(\S+).*?Source Address:\s+(\S+).*?Source Port:\s+(\S+).*?Destination Address:\s+(\S+).*?Destination Port:\s+(\S+).*?Protocol:\s+(\S+).*?Filter Run-Time ID:\s+(\S+).*?Layer Name:\s+(\S+).*?Layer Run-Time ID:\s+(\S+)<br />
DEST_KEY = _raw<br />
FORMAT = Trimmed Event EventCode=$1 $2 $4 $5 $6 $7 $8 $9 $10 $11 $12 $13 $14 $3<br />
<br />
This ended up taking those logs, which would run about 700 bytes, down to 150(-). In the end with those 2 changes (3 events) I cut out multiple hundred gigs in license volume.<br />
<br />
Now - you may be thing "why not re-write ALL Windows events." I suppose you could if you wanted. I think there is probably better things to do with your time /shrug. I at least have not taken this any further than what I have (well with the exception that I did do some of the event manipulation in Adrian's post). I should also note that one thing I wanted to do was still be able to leverage the automatic lookups within the Splunk_TA_windows app/configs. That is why I specifically left in the "EventCode=X" bit and keywords.<br />
<br />
Anyone doing anything similar or have taken a different approach?<br />
<br />
-----<br />
<span style="color: #666666;">10/02/15 Update</span><br />
<span style="color: #666666;"><br /></span>
<span style="color: #666666;">The regex above is new as it wasn't accounting for the space in "program files" /sigh at Microsoft. I'm not overly happy with the replacement solution thus far but in the few minutes of testing it appears to work. The old regex is here</span><br />
<span style="color: #666666;"><br /></span>
<span style="color: #666666;">(?ms)EventCode=(5156|5152).*?Keywords=(Audit Failure|Audit Success).*?Message=The Windows Filtering Platform (?:has )?([^\.]+).*?Process ID:\s+(\S+).*?Application Name:\s+(\S+).*?Direction:\s+(\S+).*?Source Address:\s+(\S+).*?Source Port:\s+(\S+).*?Destination Address:\s+(\S+).*?Destination Port:\s+(\S+).*?Protocol:\s+(\S+).*?Filter Run-Time</span><br />
<span style="color: #666666;"><br /></span>
<span style="color: #666666;">This also requires an update to the props field extraction. I've made the change above. The old is here</span><br />
<span style="color: #666666;"><br /></span>
<span style="color: #666666;">^Trimmed Event EventCode=(?<EventCode>5152|5156) (?<Keywords>Audit Success|Audit Failure) (?<Process_ID>\S+) (?<Application_Name>.+) (?<Direction>\S+) (?<Source_Address>\S+) (?<Source_Port>\S+) (?<Destination_Address>\S+) (?<Destination_Port>\S+) (?<Protocol>\S+) (?<Filter_Run_Time_ID>\S+) (?<Layer_Name>\S+) (?<Layer_Run_Time_ID>\S+) (?<TaskCategory>blocked a packet|permitted a connection)</span><br />
<br />
<br />Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com3tag:blogger.com,1999:blog-5581836178306074825.post-3120086009963255512014-07-03T08:29:00.002-04:002014-07-03T08:29:26.036-04:00Splunk User Activity - Apps and DashboardsAt some level time on this blog can be marked by when I'm having a car worked on. Today isn't an exception. While that means the overall frequency is low the upshot is I get to spend my morning working in Chick-fil-A with some good breakfast in mah belly and good music in the background.<br />
<br />
A couple days ago I wanted to get a feel for where users were going/how they were using Splunk. This is one of those things that seems easy but the further you go down this path the more offshoots there are. At any rate I was wanting to focus on UI navigation so knew I was going to be looking at the web access logs vs searches performed. There is a couple screens in SoS but they weren't working. There are also a couple screens in the search app (in 6x that is in Activity > System Activity) but those views, while working, didn't display what I was really after.<br />
<br />
In looking at the queries behind all of these screens I ended up with the following:<br />
<span style="color: blue;"><br /></span>
<span style="color: blue;">index=_internal source=*web_access.log* uri=*/app/* uri!=*/images/* status=200 | rex field=uri_path "app/(?<app>[^/]+)/(?<view>.+)" | where app!="launcher" AND view!="Home" AND view!="home" AND view!="landing" | table _time host app view user _raw</span><br />
<br />
<a name='more'></a><br />
It is somewhat interesting sometimes the nuances between the search and where commands which is why in this case I chose where (I think - it was 2 days ago /shrug). I'm pretty lazy at heart so I've pretty much kept this base query regardless of the stats command used. In my dashboard I could have all the panels refer back to a base search but note again the previous sentence and the reality is I will have this dashboard emailed to me once a week. At any rate you might need to adjust the query based on how many and uses of your search heads (if you have more than one) or whitelist your Splunk admins so the numbers aren't skewed. Remember this is simply for navigation within the UI and does not capture the types and number of searches. In other words if someone navigates to dashboard X in app Y and then uses that dashboard 150 times in one day it will only show up in the context of this search 1 time (unless their session times out and they log back in causing the page to refresh).<br />
<br />
To skip ahead just a bit one of the things you will likely want to do, especially depending on audience, is to translate the app into the something people can read using the app's label. I accomplished this with a join to a REST search like this<br />
<br />
... base search ... | stats ...<span style="color: blue;"> | join app [| rest splunk_server=local /services/apps/local/ | rename title as app</span> | table app label] | ...clean up ...<br />
<br />
When you go to answer questions like which apps are the most popular you have at least 2 ways of addressing that. The first is by looking at the app with the highest number of unique people hitting it (this query trims the list to the top 5)<br />
<br />
<span style="color: blue;">index=_internal source=*web_access.log* uri=*/app/* uri!=*/images/* status=200 | rex field=uri_path "app/(?<app>[^/]+)/(?<view>.+)" | where app!="launcher" AND view!="Home" AND view!="home" AND view!="landing" | table _time host app view user _raw | stats dc(user) as "Unique Users" by app | join app [| rest splunk_server=local /services/apps/local/ | rename title as app | table app label] | table label "Unique Users" | sort -"Unique Users" | rename label as App | head 5</span><br />
<br />
The other way to answer the question is by the most views - again this query is looking at the top 5<br />
<br />
<span style="color: blue;">index=_internal source=*web_access.log* uri=*/app/* uri!=*/images/* status=200 | rex field=uri_path "app/(?<app>[^/]+)/(?<view>.+)" | where app!="launcher" AND view!="Home" AND view!="home" AND view!="landing" | table _time host app view user _raw | stats count as "Total Views" by app | join app [| rest splunk_server=local /services/apps/local/ | rename title as app | table app label] | table label "Total Views" | sort -"Total Views" | rename label as App | head 5</span><br />
<br />
The resulting data is pretty small so I have those as dashboard panels side by side. The next query shows a number of stats by app: total views, unique users, and number of unique dashboards accessed w/in the app. I also wanted to bake in a little bit of a trend over time w/o using timechart so used the sparkline command.<br />
<br />
<span style="color: blue;">index=_internal source=*web_access.log* uri=*/app/* uri!=*/images/* status=200 | rex field=uri_path "app/(?<app>[^/]+)/(?<view>.+)" | where app!="launcher" AND view!="Home" AND view!="home" AND view!="landing" | table _time host app view user _raw | stats sparkline as "Usage Trend by Day" dc(user) as "Unique Users" dc(view) as "Unique Dashboards" count as "Total Views" by app | join app [| rest splunk_server=local /services/apps/local/ | rename title as app | table app label] | table label "Usage Trend by Day" "Unique Users" "Unique Dashboards" "Total Views" | rename label as App| sort -"Total Views"</span><br />
<br />
The last query is one that shows which dashboard was accessed by app. The display is one I favor from a logical grouping perspective and is accomplished by using multiple stats commands. As an aside - multiple stats commands are also useful from a drill down perspective.<br />
<br />
<span style="color: blue;">index=_internal source=*web_access.log* uri=*/app/* uri!=*/images/* status=200 | rex field=uri_path "app/(?<app>[^/]+)/(?<view>.+)" | where app!="launcher" AND view!="Home" AND view!="home" AND view!="landing" | table _time host app view user _raw | stats count by app view user | stats sum(count) as total_views dc(user) as distinct_users by app view | sort -total_views | stats list(view) as Dashboard list(total_views) as Views list(distinct_users) as "Distinct Users" by app | join app [| rest splunk_server=local /services/apps/local/ | rename title as app | table app label] | table label Dashboard Views "Distinct Users" | rename label as App| sort label</span><br />
<br />
Hopefully this is helpful. I feel like I should incorporate user names somehow but haven't gotten that far. Might add that from a drill down perspective or as additional panels. In 6x it is easy to add a time range picker to a dashboard which is what I've done for the above with the default of 7 days. Anyone doing something similar? Would be interested in seeing what you are doing and comparing notes.<br />
<br />
MarkMarkhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-46720594458651424782014-06-16T12:06:00.003-04:002014-06-16T12:06:50.205-04:00Events of Interest from a Splunk Admin perspectiveAs our deployment has grown from basically myself performing administrative duties to adding a second body as well as running into a couple other things we've wanted increased visibility when certain activities have taken place. Over time we've merged these into a rather ugly query. It has proved itself a time or three though so figured I'd share. In putting something like this into place you need to figure out a few things. How frequently it will run, who it goes to, etc. You might find you want certain aspects to run more frequently than others which would require more than one query. YMMV<div>
<a name='more'></a></div>
<div>
Actions this query captures:</div>
<div>
<ul>
<li>Splunk forwarder directory out of space (or possibly an inode issue)</li>
<li>When the Splunk delete command has been used</li>
<li>Failed login attempts (webui)</li>
<li>When the serverclass.conf file is referencing an app/config package that doesn't exist</li>
<li>Local Splunk accounts that have been created or deleted</li>
</ul>
<div>
<br /></div>
<div>
What administrative events is the query missing?</div>
<div>
<br /></div>
<div>
(index=_internal "No space left on device") OR (index=_audit "| delete" NOT "index=*_audit") OR (index=_audit action="login attempt" info=failed sourcetype="audittrail") OR (index=_internal source=*splunkd.log component=serverclass warn NOT "machineTypes in app * is deprecated") OR (index=_audit action=edit_user (operation=create OR operation=remove)) | eval Alert = case(action="edit_user" AND operation="create", "User account created", action="edit_user" AND operation="remove", "User account deleted", match(_raw, "Unable to load application"), "Serverclass.conf issue", match(_raw, "delete"), "Delete used", action="login attempt" AND info="failed", "Failed local login", match(_raw,"No space left on device"), "No space on device", 1=1, "fix me" ) | eval Message = case(Alert="User account deleted", "User: " .user. " Deleted: " .object, Alert="User account created", "User: " .user. " Created: " .object, Alert="Failed local login", "User: " .user, Alert="Delete used", "User: " .user. " Search: " .search, Alert="Serverclass.conf issue", message. " (Probably a spelling issue)", Alert="No space on device", "Diskspace or inodes issues", 1=1, "fix me") | eval a_time = strftime(_time,"%m/%d/%y %k %p") | stats count by a_time host Alert Message</div>
</div>
Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0tag:blogger.com,1999:blog-5581836178306074825.post-7892152835404407142014-05-05T11:25:00.000-04:002014-05-05T11:26:01.286-04:00Splunk DateParserVerbose logs - Part 2In <a href="http://runals.blogspot.com/2014/04/splunk-timestamps-and-dateparserverbose.html" target="_blank">part 1</a> of this subject we talked about what Splunk's DateParserVerbose internal logs are and I gave an example query that at its heart attempts to rollup and summarize timestamp related issues. In this post I'll present a query for taking the sourcetypes Splunk is having issues with from a timestamp perspective and display the relevant props configs. What we've done is thrown both queries into the same dashboard to make things easier to work though. I should note a couple things here. The first is the foreach command is only available in Splunk 6 (I believe). The second is the REST endpoint I'm getting the config data from is likely only available in 6.<br />
<div>
<br /></div>
<div>
With that out of the way here is the query:</div>
<div>
<a name='more'></a></div>
<div>
<div class="p1">
| rest /servicesNS/-/-/configs/conf-props | eval sourcetype = if(isnull(sourcetype), title, sourcetype) | rename eai:appName as App | search App!=system App!=learned <span style="color: blue;">[search index=_internal DateParserVerbose | rex "source::(?<Source>[^\|]+)\|host::(?<Host>[^\|]+)\|(?<sourcetype>[^\|]+)" | dedup sourcetype | fields sourcetype] </span> | eval SHOULD_LINEMERGE = if(SHOULD_LINEMERGE=0, "False", "True / Default") | dedup App sourcetype | table sourcetype App TIME_FORMAT TIME_PREFIX MAX_TIMESTAMP_LOOKAHEAD LINE_BREAKER TZ SHOULD_LINEMERGE MAX_DAYS_AGO TRUNCATE | foreach * [eval <<FIELD>> = if(isnull(<<FIELD>>),"Null",<<FIELD>>)] | foreach * [eval <<FIELD>> = '<<FIELD>>'."##".sourcetype."##".App."||"] | stats values(*) as *| transpose | makemv delim="|| " "row 1" | mvexpand "row 1" | search column!=App column!=sourcetype | rex field="row 1" "^(?<value>[^\#]+)##(?<sourcetype>[^\#]+)##(?<app>[^\#]+)" | eval value = if(value="Null","-",value) | table app sourcetype column value | sort app sourcetype column | stats list(column) as setting list(value) as value by app sourcetype</div>
<div class="p1">
<br /></div>
<div class="p1">
The upper case props attributes call undo attention to themselves =). The blue portion of the query is a subquery that if you notice is the same as what the query in the previous post started with. The reason is since we are pulling out config data we might as well just concentrate on the ones relevant to the sourcetypes Splunk is having issues with. There is a whole other conversation to be had on using the REST query to show configs w/o having to go to the command line - but that is something for another day. </div>
<div class="p1">
<br /></div>
<div class="p1">
So what is this query doing? It starts by hitting the config-props REST endpoint and then does some monkeying around and renames the app name field to make it easier to work with and ultimately is self trimming the results based on the sourcetypes that are having issues (subquery). I'm doing eval on line merging because sometimes you want to line merge in your events but that is also the default setting so you may have never actually set it. If you have ever seen the Splunk preso on getting data in correctly you will recognize the 7 fields in the table and have added max days ago as it can often show up from the previous query. If you haven't seen it try to get a hold of the .conf2012/.conf2013 slide deck. Make an effort to get these populated. For the moment we will ignore the irony of many sourcetype attribute settings in the Splunk Exchange TAs not being set. The rest of the query is somewhat harder to explain and would suggest running the query pipe by pipe. Frankly speaking a good bit of the query is based around my preference to have results in the format these end up in =).</div>
<div class="p1">
<br /></div>
<div class="p1">
<br /></div>
</div>
Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com1tag:blogger.com,1999:blog-5581836178306074825.post-84171278434822054742014-04-09T08:32:00.001-04:002014-04-09T08:33:12.785-04:00Detecting OpenSSL version data in SplunkI won't go into the HeartBleed details as you likely already know them. From a Splunk perspective there are any number of ways to try to get your arms around this issue but are highly dependent on the types of data you are collecting. That said, if you are using the Splunk Linux TA and have the package script enabled and/or the Windows TAs and have the InstalledApps_Windows script turned on you could use the following queries to extract the OpenSSL version. You could also combine the queries but for the purposes of posting them here that would make it harder to read /shrug. Obviously adjust based on changes you've made (ie sourcetype)<br />
<br />
<b>Linux</b><br />
sourcetype=package | multikv | search NAME=openssl | dedup host ARCH | eval HBconcern = case(match(VERSION,"(^0\.\d\.\d|^1\.0\.0)"), "Too Low", match(VERSION,"^A"), "HP (Not familiar)", match(VERSION,"^1\.0\.1[a-f]"), "Potentially Susceptible", match(VERSION,"^1\.0\.1[g-z]"), "Patched", match(VERSION,"^1\.0\.2-beta"), "Potentially Susceptible", 1=1, "fixme") | table host NAME VENDOR GROUP VERSION ARCH Hbconcern | sort host<br />
<div class="p1">
<br /></div>
<div class="p1">
<b>Windows</b></div>
<div class="p1">
</div>
<div class="p1">
sourcetype=InstalledApps_Windows DisplayName=openssl | rex "DisplayName=OpenSSL\s+(?<VERSION>\S+)\s+\((?<ARCH>[^\)]+)"| dedup host ARCH | eval HBconcern = case(match(VERSION,"(^0\.\d\.\d|^1\.0\.0)"), "Too Low", match(VERSION,"^A"), "HP (Not familiar)", match(VERSION,"^1\.0\.1[a-f]"), "Potentially Susceptible", match(VERSION,"^1\.0\.1[g-z]"), "Patched", match(VERSION,"^1\.0\.2-beta"), "Potentially Susceptible", 1=1, "fixme") | table host VERSION ARCH HBconcern | sort host</div>
<div class="p1">
<br /></div>
<div class="p1">
What I'm not sure on is the regex for the 1.0.2-beta as I haven't actually seen that version installed. I'm guessing it shows up like that. </div>
Markhttp://www.blogger.com/profile/08030652728374177054noreply@blogger.com0