Why does the AND operator does not return results?

bugnet — Sun, 02 Jun 2019 08:53:26 GMT

Hi,

for some reason AND operator does not return the results, while OR operator does.
What is the way to get only the first result in the following table?

search:

(index=misp-events source="/var/scripts/events/*.json") (tag_name="misp-galaxy:continents=\"Asia\"" OR tag_name="misp-galaxy:targeted-region=\"Ukraine\"" OR tag_name="misp-galaxy:ransomware=\"*") | transaction source|table source,tag_name

Table:

Re: Why does the AND operator does not return results?

DavidHourani — Sun, 02 Jun 2019 12:02:11 GMT

Hi @bugnet,

The AND does not work because the tag for the same source are not for the same event, they are for multiple events with the same source field. When using AND a single event MUST match all the conditions.

In your case you have to use the OR and the most efficient way to keep the one that matches all three conditions is as follows :

 (index=misp-events source="/var/scripts/events/*.json") (tag_name="misp-galaxy:continents=\"Asia\"" OR tag_name="misp-galaxy:targeted-region=\"Ukraine\"" OR tag_name="misp-galaxy:ransomware=\"*") |stats dc(tag_name) as n_of_tags, values(tag_name) as tag_name by source |where n_of_tags >2

Cheers,
David

topic Re: Why does the AND operator does not return results? in Getting Data In

Why does the AND operator does not return results?

Re: Why does the AND operator does not return results?