How to implement multiple where conditions with like statement using tstats?

[woodentree]

Hello,

We'd like to monitor configuration changes on our Linux host. For that we want to detect when in the datamodel Auditd the field nameis equal to /etc/audit/*, /etc/audisp/*, or /etc/libaudit.conf. Here is our basic search:

| tstats `security_content_summariesonly` count  from datamodel=Auditd where nodename=Auditd.Path by _time span=1s host Auditd.name
| `drop_dm_object_name("Auditd")`

The question is how can we implement in the same search 3 conditions below:

| where like(name,"%/etc/audit/%")
| where like(name,"%/etc/audisp/%")
| where name="/etc/libaudit.conf"

Logicaly it could be done via case statement, but we wasn't able to implement it. Do you have any ideas?

Thanks for the help.

[sumanssah · Accepted solution]

Try something like

 | tstats `security_content_summariesonly` count  from datamodel=Auditd where nodename=Auditd.Path by _time span=1s host Auditd.name     | `drop_dm_object_name("Auditd")`     

  | search name="*/etc/audit/*" OR name="*/etc/audisp/*" OR name="*/etc/libaudit.conf*"

[woodentree]

Exactly!
Thanks for the help.

[cotyp]

how about a multiple if statement? if(like(name, "etc....%"), "etc",if(like(name, "%audisp%"), "audisp"))

[woodentree]

Hi @cotyp,
With tstats you can use only from, where and by clause arguments. Personally I don't know how can I implement multiple if statements with these argements 😞