Recursive query based upon current result set

catsmeowor — Mon, 17 Dec 2018 23:55:26 GMT

Having some trouble figuring this out, and fishing for an example as well.

Have an index that contains URL traffic logs. The category of these logs is dynamically updated each day.

index=url_logs category=malware | table user category url --> i get my results if there's any hits

But i what I'd like to do is to search for anything that currently matches malware on today's date with a search going back at least a week. That way I could tell if there was a lot of allowed traffic to a site that is now malicious and investigate from there.

Any suggestions? Thank you!

Re: Recursive query based upon current result set

valiquet — Fri, 21 Dec 2018 13:28:12 GMT

index=url_logs url=* | stats values(user), values(url) by category | where category=malware

topic Re: Recursive query based upon current result set in Getting Data In

Recursive query based upon current result set

Re: Recursive query based upon current result set