diff --git a/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml b/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml
index 21f6d988de..996b8ead9d 100644
--- a/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml
+++ b/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml
@@ -1,14 +1,14 @@
 name: Kubernetes AWS detect suspicious kubectl calls
 id: 042a3d32-8318-4763-9679-09db2644a8f2
-version: 1
-date: '2020-06-23'
+version: 2
+date: '2022-11-11'
 author: Rod Soto, Splunk
 type: Hunting
 datamodel: []
 description: This search provides information on anonymous Kubectl calls with IP,
   verb namespace and object access context
 search: '`aws_cloudwatchlogs_eks` userAgent=kubectl* sourceIPs{}!=127.0.0.1 sourceIPs{}!=::1
-  src_user=system:anonymous  | table  src_ip src_user verb userAgent requestURI  |
+  src_user=system:anonymous  |
   stats  count by src_ip src_user verb userAgent requestURI |`kubernetes_aws_detect_suspicious_kubectl_calls_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with cloudwatch logs.