Query A/Dataset A
sourcetype=aws_cloudtrail eventtime > "2021-01-01T00:00:00Z" AND eventtime < "2021-01-31T23:59:59Z" | stats values(eventnames) by accesskeyid
output:
accesskeyid. values(eventnames)
ABCD. ListTopic CreateTopic
EFGH. CreateStream
Query B/Dataset B
sourcetype=aws_cloudtrail eventtime > "2021-04-01T00:00:00Z" AND eventtime < "2021-04-28T23:59:59Z" | stats values(eventnames) by accesskeyid
output:
accesskeyid. values(eventnames)
ABCD ListTopic ListBuckets Createtopic
EFGH. CreateStream DeleteStream
DEF. ListTickets
Ask:
Please provide a query where i need the output like below where only the unique values of eventnames from datasetB group by acesskeyid should be listed out when i run both the queries at the same search
output:
accesskeyid. values(eventnames)
ABCD ListBuckets
EFGH. DeleteStream
DEF. ListTickets
Thanks inn advance
sourcetype=aws_cloudtrail (eventtime > "2021-01-01T00:00:00Z" AND eventtime < "2021-01-31T23:59:59Z") OR (eventtime > "2021-04-01T00:00:00Z" AND eventtime < "2021-04-28T23:59:59Z")
| eval eventnamesA=if(eventtime > "2021-01-01T00:00:00Z" AND eventtime < "2021-01-31T23:59:59Z",eventnames,null)
| eventstats values(eventnamesA) as eventnamesA by accesskeyid
| eval eventnames=if(isnull(mvfind(eventnamesA,eventnames)),eventnames,null)
| stats values(eventnames) by accesskeyid
My bad, i mentioned the timelines wrong its the following eventtime > "2021-01-01T00:00:00Z" AND eventtime < "2021-03-31T23:59:59Z"
Ran the query but it does not fetch the expected result 😞
I assume eventnames is already extracted as a field? Can you share some anonymised events?
The field is not eventnames but eventname, my bad i executed with eventnames
Thanks ITWhisperer for your help
sourcetype=aws_cloudtrail (eventtime > "2021-01-01T00:00:00Z" AND eventtime < "2021-01-31T23:59:59Z") OR (eventtime > "2021-04-01T00:00:00Z" AND eventtime < "2021-04-28T23:59:59Z")
| eval eventnamesA=if(eventtime > "2021-01-01T00:00:00Z" AND eventtime < "2021-01-31T23:59:59Z",eventnames,null)
| eventstats values(eventnamesA) as eventnamesA by accesskeyid
| eval eventnames=if(isnull(mvfind(eventnamesA,eventnames)),eventnames,null)
| stats values(eventnames) by accesskeyid