Add fields to tstat results

[girtsgr]

Hi!

I want to use a tstats search to monitor for network scanning attempts from a particular subnet:

| tstats `summariesonly` dc(All_Traffic.dest) as dest_count from datamodel=Network_Traffic.All_Traffic where (All_Traffic.dest="10.*" OR All_Traffic.dest="172.*" OR All_Traffic.dest="192.168.*") AND All_Traffic.src=10.128.0.0/16   by All_Traffic.src 
| sort - dest_count 
| where dest_count > 70 

My index2 contains IP addresses and users (src_ip, user and event contains text string "LOCAL") that I would like to match with the All_Traffic.src IP addresses, so I would get the last user name that used the particular All_Traffic.src in the results. I have tried both join and map with no success:

| tstats `summariesonly` dc(All_Traffic.dest) as dest_count from datamodel=Network_Traffic.All_Traffic where (All_Traffic.dest="10.*" OR All_Traffic.dest="172.*" OR All_Traffic.dest="192.168.*") AND All_Traffic.src=10.128.0.0/16   by All_Traffic.src 
| sort - dest_count 
| where dest_count > 70 
| rename All_Traffic.src AS src_ip
| join type=left src_ip 
    [search index=index2 "LOCAL" 
    | head 1 
    | fields src_ip user ] 
| table All_Traffic.src dest_count user

join returns All_Traffic.src and dest_count without users.

| tstats `summariesonly` dc(All_Traffic.dest) as dest_count from datamodel=Network_Traffic.All_Traffic where (All_Traffic.dest="10.*" OR All_Traffic.dest="172.*" OR All_Traffic.dest="192.168.*") AND All_Traffic.src=10.128.0.0/16   by All_Traffic.src 
| sort - dest_count 
| where dest_count > 70 
| rename All_Traffic.src AS srcip
| map search="search index=index2 "LOCAL" src_ip=$srcip$ | head 1 | fields user" 
| table All_Traffic.src dest_count user

map returns users, but no All_Traffic.src and dest_count

What is the correct way to get the results I need?

Thank you.

[HiroshiSatoh · Accepted solution]

 | map search="search index=index2 "LOCAL" src_ip=$srcip$ | head 1 | fields user" 
 →
 | map search="search index=index2 "LOCAL" src_ip=$srcip$ | head 1 |eval dest_count =$dest_count$ | fields src_ip dest_count user" 

[girtsgr]

Can you post this as an answer, so I can mark it as the correct one? I don't have the option to do this on a comment. Thanks 🙂

[girtsgr]

This works, thank you very much!

[to4kawa]

| table All_Traffic.src dest_count user
→
| table src_ip dest_count user

you renamed the field.