topic Re: How can I find computers that have been infected for three consecutive days? in Splunk Search

How can I find computers that have been infected for three consecutive days?

superhm — Mon, 24 Apr 2017 05:02:16 GMT

I want to find the host IPs for three consecutive days of antivirus detection.
Please help me.
ex)
- sourcetype: virusalert

The names of the fields
- CLIENTIP
- VIRUSNAME
- TIME

Re: How can I find computers that have been infected for three consecutive days?

dineshraj9 — Mon, 24 Apr 2017 05:07:44 GMT

You can run a search for 3 days and do a distinct count based on date_mday(day of the month) -

sourcetype=virusalert | stats dc(date_mday) as count,max(TIME) as RECENT_ATTACK_TIME by CLIENTIP,VIRUSNAME | where count > 2

Re: How can I find computers that have been infected for three consecutive days?

superhm — Tue, 29 Sep 2020 13:46:25 GMT

Thank you for your advice!
I can get DATA what I want.

Here is my full query.

index=AV sourcetype=virusalert earliest=-4d@d latest=-1d@d
| eval REG_DATE=strftime(_time, "%Y-%m-%d")
| stats dc(date_mday) as count, max(REG_DATE) as RECENT_ATTACK_TIME by CLIENTIP, VIRUSNAME
| where count >2
| table RECENT_ATTACK_TIME, CLIENTIP, VIRUSNAME

Thanks again.