Having some trouble figuring this out, and fishing for an example as well.
Have an index that contains URL traffic logs. The category of these logs is dynamically updated each day.
index=url_logs category=malware | table user category url --> i get my results if there's any hits
But i what I'd like to do is to search for anything that currently matches malware on today's date with a search going back at least a week. That way I could tell if there was a lot of allowed traffic to a site that is now malicious and investigate from there.
Any suggestions? Thank you!
