topic Re: how Join two search in one table? in Getting Data In

how Join two search in one table?

nidet — Mon, 28 Sep 2020 19:05:52 GMT

I need to make a search that can list the different IP (On occasions the ip will not be in the previous month but in the current month.) and vulnerabilities of the current month and last month in two columns.

example, this correct, manual
Ip - Last month - Current Month
192.168.32.3 - 3 - 1
192.168.32.8 - 10 - 5
192.168.32.162 - 5 - 0
192.168.32.165 - 4 - 1

but the source is inconsistent
192.168.32.3 - 0 - 1
192.168.32.8 - 1 - 4
192.168.32.162 - 1 - 0
192.168.32.163 -4 - 1
192.168.32.165 -3 - 5
when a new ip data is changed, is incorrect

sourcetype=" " org_id="" earliest=-1mon@mon latest=@mon NOT vuln_risk=0 | chart count over ip by vuln_risk | addtotals fieldname="Current Month" |appendcols [search sourcetype=" " org_id="" earliest=-1mon@mon-1@mon latest=@mon-1@mon NOT vuln_risk=0 | chart count over ip by vuln_risk | addtotals fieldname="Previous Month"]|fields - 1,4,8 | rename ip as "Vulnerable Hosts" | sort - "Current Month"

Anyone have a better idea???? Please

Re: how Join two search in one table?

ltrand — Fri, 06 Mar 2015 20:26:09 GMT

Have you thought about using lookup tables? That way you can populate it with a search and hold a longer history without having to keep as much raw data. It would make the comparision easy.

Re: how Join two search in one table?

somesoni2 — Wed, 11 Mar 2015 17:19:44 GMT

Give this a try

sourcetype=YourSourcetype org_id="" earliest=-2mon@mon latest=@mon vuln_risk!=0 | eval Period=if(_time<relative_time(now(),"-1mon@mon"),"Previous Month","Current Month") | chart count over ip by Period

Re: how Join two search in one table?

nidet — Mon, 28 Sep 2020 19:13:10 GMT

Now if I can see the ip that were not seen with the other codes to try, now there ips, which doubles its total 4 top and 4 at the end.
incorrect
192.168.32.3 - 2-2
192.168.32.8 - 2-8
192.168.32.10 - 2-2
192.168.32.11 - 2- 6

This is the case correct
192.168.32.3 - 1-1
192.168.32.8 - 1-4
192.168.32.10 - 1-1
192.168.32.11 - 1- 3

you know for some reason it is? I thought was missing | dedup ip, vuln_risk, vuln_name .. but not funtion

Re: how Join two search in one table?

nidet — Thu, 12 Mar 2015 18:34:13 GMT

this really grateful for the help of code that sent