Search Across Multiple Saved Search Results

[jodros]

Currently I have three scheduled searches that run once a day to baseline possible APT on our network by showing the top 25 hosts for total bytes, connections and length of time for connections through our firewall. The searches take some time to run even with report acceleration enabled, so they are run during the night. I would like to identify hosts that show up on all three top 25 reports. I have all three in a dashboard that allows me to manually view and identify hosts, however it would be easier if it could also be automated. What I would like is to have a search run across the result sets of the three top 25 APT reports that would display any host showing up on all three.

If anyone has any suggestions, I would appreciate it. Thanks in advance.

[martin_mueller]

You could have your saved searches dump their output into lookups or a summary index, and work your way from there using three inputlookups appended to each other or a search on that summary index.

[somesoni2]

I believe summary indexing is what you need