I want to find the host IPs for three consecutive days of antivirus detection.
Please help me.
ex)
- sourcetype: virusalert
The names of the fields
- CLIENTIP
- VIRUSNAME
- TIME
You can run a search for 3 days and do a distinct count based on date_mday(day of the month) -
sourcetype=virusalert | stats dc(date_mday) as count,max(TIME) as RECENT_ATTACK_TIME by CLIENTIP,VIRUSNAME | where count > 2
You can run a search for 3 days and do a distinct count based on date_mday(day of the month) -
sourcetype=virusalert | stats dc(date_mday) as count,max(TIME) as RECENT_ATTACK_TIME by CLIENTIP,VIRUSNAME | where count > 2
Thank you for your advice!
I can get DATA what I want.
Here is my full query.
index=AV sourcetype=virusalert earliest=-4d@d latest=-1d@d
| eval REG_DATE=strftime(_time, "%Y-%m-%d")
| stats dc(date_mday) as count, max(REG_DATE) as RECENT_ATTACK_TIME by CLIENTIP, VIRUSNAME
| where count >2
| table RECENT_ATTACK_TIME, CLIENTIP, VIRUSNAME
Thanks again.