{
    "modelName": "Usernames_with_Blank_Password_Fields",
    "displayName": "Usernames with Blank Password Fields",
    "description": "",
    "objectSummary": {
        "Event-Based": 0,
        "Transaction-Based": 0,
        "Search-Based": 1
    },
    "objects": [
        {
            "objectName": "RootObject",
            "displayName": "1579144557.2819",
            "parentName": "BaseSearch",
            "comment": "",
            "fields": [
                {
                    "fieldName": "host",
                    "owner": "RootObject",
                    "type": "string",
                    "fieldSearch": "",
                    "required": false,
                    "multivalue": false,
                    "hidden": false,
                    "editable": true,
                    "displayName": "host",
                    "comment": ""
                },
                {
                    "fieldName": "source",
                    "owner": "RootObject",
                    "type": "string",
                    "fieldSearch": "",
                    "required": false,
                    "multivalue": false,
                    "hidden": false,
                    "editable": true,
                    "displayName": "source",
                    "comment": ""
                },
                {
                    "fieldName": "data.name",
                    "owner": "RootObject",
                    "type": "string",
                    "fieldSearch": "",
                    "required": false,
                    "multivalue": false,
                    "hidden": false,
                    "editable": true,
                    "displayName": "data.name",
                    "comment": ""
                },
                {
                    "fieldName": "data.results.user.username",
                    "owner": "RootObject",
                    "type": "string",
                    "fieldSearch": "",
                    "required": false,
                    "multivalue": false,
                    "hidden": false,
                    "editable": true,
                    "displayName": "data.results.user.username",
                    "comment": ""
                },
                {
                    "fieldName": "data.status",
                    "owner": "RootObject",
                    "type": "string",
                    "fieldSearch": "",
                    "required": false,
                    "multivalue": false,
                    "hidden": false,
                    "editable": true,
                    "displayName": "data.status",
                    "comment": ""
                },
                {
                    "fieldName": "header.hostname",
                    "owner": "RootObject",
                    "type": "string",
                    "fieldSearch": "",
                    "required": false,
                    "multivalue": false,
                    "hidden": false,
                    "editable": true,
                    "displayName": "header.hostname",
                    "comment": ""
                },
                {
                    "fieldName": "sourcetype",
                    "owner": "RootObject",
                    "type": "string",
                    "fieldSearch": "",
                    "required": false,
                    "multivalue": false,
                    "hidden": false,
                    "editable": true,
                    "displayName": "sourcetype",
                    "comment": ""
                },
                {
                    "fieldName": "_time",
                    "owner": "RootObject",
                    "type": "timestamp",
                    "fieldSearch": "",
                    "required": false,
                    "multivalue": false,
                    "hidden": false,
                    "editable": true,
                    "displayName": "_time",
                    "comment": ""
                }
            ],
            "calculations": [],
            "constraints": [],
            "lineage": "RootObject",
            "baseSearch": "index=\"*\" sourcetype=\"sandfly:alarms\" data.name=\"recon_user_list_all\" | spath \"data.results.user.password.empty\"  | search \"data.results.user.password.empty\"=true"
        }
    ],
    "objectNameList": [
        "RootObject"
    ]
}
