How can I execute two Netwitness query sentence at the same time? how to configure this?

[fish111]

for example
query=select time,sessionid,ip.src,ip.dst,tcp.dstport where ioc='monero mining'
query=select time,sessionid,ip.src,ip.dst,tcp.dstport,tcp.srcport where ip.src=10.100.0.0/16

tks!

[dflodstrom]

To run a second NetWitness query using this app, netwitness_query, you can copy the nwsdk_query.conf file to a new file likenwsdk_query_dns.conf. Configure the query and last_mid_file values and then create a stanza for this file in inputs.conf. [script://./bin/nwsdk_query.py nwsdk_query_dns].

@rataide provided this answer in the comments, I only expanded on it slightly. There is no need to copy or modify the script.

[rataide]

An alternative solution is to just use an || (OR in NetWitness syntax) on the clause part of the query. Example:

query=select time,sessionid,ip.src,ip.dst,tcp.dstport,tcp.srcport where ip.src=10.100.0.0/16 || ioc='monero mining'

Hope these help!

Regards,

Rui

[fish111]

first .i copy nwsdk_query.conf and modify the query sentence as nwsdk_query2.conf in the same directory
second i copy nwsdk_query.py and modify the code which include config file, than i name it as nwsdk_query2
then create a new loca script which named $SPLUNK_HOME\etc\apps\netwitness_query\bin\nwsdk_query2.py ,everything got done

[woodcock]

If this is the answer that worked best for you, you should click Accept to close the question and also UpVote any other comments or answers that helped you along.

[rataide]

Actually, you don't need a second python script in bin, you can just create an additional input stanza in inputs.conf and pass the new configuration file as a parameter. Example below:

[script://./bin/nwsdk_query.py nwsdk_query2]

[script://./bin/nwsdk_query.py myquery_ip]

etc... you can do this as many times as you need.

[DalJeanis]

@fish111 - Thanks for the description. We've updated the title of your question to have more information about what you were trying to achieve, and converted your comment to an answer.

You can "accept" your answer so the question will show as answered.

[harishalipaka]

@fish111

try with append or appendpipe

[fish111]

thanks for your answer,but i try another method ,and solve the problem.

[DalJeanis]

@fish111 - please write an answer describing how you solved the problem, and accept your answer. This will help future people who have similar questions.