Hello,
I'm working on analysis of data coming from some web scan app.
I have to compare the results from two scan executions. Inspired by this answer I've got this working:
| set diff [search index=webscan sourcetype=webscan message="Done exchange {exchange}" scanId=110cf971-c319-41dc-b58c-670f4c141cf1 execId=2018-05-24T20:59:18| stats count by eventProperties.exchange.PluginId, eventProperties.exchange.Url | table eventProperties.exchange.PluginId, eventProperties.exchange.Url] [search index=webscan sourcetype=webscan message="Done exchange {exchange}" scanId=110cf971-c319-41dc-b58c-670f4c141cf1 execId=2018-05-24T18:57:32 | stats count by eventProperties.exchange.PluginId, eventProperties.exchange.Url | table eventProperties.exchange.PluginId, eventProperties.exchange.Url]
The problem appears when I try to use a data model in subsearches - the following does not work (shows "No results found"):
| set diff [| datamodel WebScan Exchanges search | search scanId=110cf971-c319-41dc-b58c-670f4c141cf1 execId=2018-05-24T20:59:18| stats count by eventProperties.exchange.PluginId, eventProperties.exchange.Url | table eventProperties.exchange.PluginId, eventProperties.exchange.Url] [| datamodel WebScan Exchanges search | search scanId=110cf971-c319-41dc-b58c-670f4c141cf1 execId=2018-05-24T18:57:32 | stats count by eventProperties.exchange.PluginId, eventProperties.exchange.Url | table eventProperties.exchange.PluginId, eventProperties.exchange.Url]
in spite of the fact that subsearches run separatly works as expected.
What should be changed?
Ultimately, I would like to define a macro exchanges_of(2) like
datamodel WebScan Exchanges search | search scanId=$scanId$, execId=$execId$ | stats count by eventProperties.exchange.PluginId, eventProperties.exchange.Url | table eventProperties.exchange.PluginId, eventProperties.exchange.Url
and do this:
| set diff [|`exchanges_of(110cf971-c319-41dc-b58c-670f4c141cf1, 2018-05-24T20:59:18)`] [|`exchanges_of(110cf971-c319-41dc-b58c-670f4c141cf1,2018-05-24T18:57:32)`]
but this also returns "No results found."
And it would be great if I could do something like
| `exchanges_of(110cf971-c319-41dc-b58c-670f4c141cf1, 2018-05-24T20:59:18)` NOT [|`exchanges_of(110cf971-c319-41dc-b58c-670f4c141cf1,2018-05-24T18:57:32)`]
for "one side" diff. Is it possible?
