how Join two search in one table?

[nidet]

I need to make a search that can list the different IP (On occasions the ip will not be in the previous month but in the current month.) and vulnerabilities of the current month and last month in two columns.

example, this correct, manual
Ip - Last month - Current Month
192.168.32.3 - 3 - 1
192.168.32.8 - 10 - 5
192.168.32.162 - 5 - 0
192.168.32.165 - 4 - 1

but the source is inconsistent
192.168.32.3 - 0 - 1
192.168.32.8 - 1 - 4
192.168.32.162 - 1 - 0
192.168.32.163 -4 - 1
192.168.32.165 -3 - 5
when a new ip data is changed, is incorrect

sourcetype=" " org_id="" earliest=-1mon@mon latest=@mon NOT vuln_risk=0 | chart count over ip by vuln_risk | addtotals fieldname="Current Month" |appendcols [search sourcetype=" " org_id="" earliest=-1mon@mon-1@mon latest=@mon-1@mon NOT vuln_risk=0 | chart count over ip by vuln_risk | addtotals fieldname="Previous Month"]|fields - 1,4,8 | rename ip as "Vulnerable Hosts" | sort - "Current Month"

Anyone have a better idea???? Please

[somesoni2 · Accepted solution]

Give this a try

sourcetype=YourSourcetype org_id="" earliest=-2mon@mon latest=@mon vuln_risk!=0 | eval Period=if(_time<relative_time(now(),"-1mon@mon"),"Previous Month","Current Month") | chart count over ip by Period

[nidet]

Now if I can see the ip that were not seen with the other codes to try, now there ips, which doubles its total 4 top and 4 at the end.
incorrect
192.168.32.3 - 2-2
192.168.32.8 - 2-8
192.168.32.10 - 2-2
192.168.32.11 - 2- 6

This is the case correct
192.168.32.3 - 1-1
192.168.32.8 - 1-4
192.168.32.10 - 1-1
192.168.32.11 - 1- 3

you know for some reason it is? I thought was missing | dedup ip, vuln_risk, vuln_name .. but not funtion

[nidet]

this really grateful for the help of code that sent

[ltrand]

Have you thought about using lookup tables? That way you can populate it with a search and hold a longer history without having to keep as much raw data. It would make the comparision easy.