Compare two searches and show differences

[jpetrov]

Hi All,

I'm trying to gain some visibility into whether scans are completing on all hosts, at the moment they are not and I would like to easily see which ones are not working properly. I want to have three panels. One showing all hosts, the next showing all hosts in which scans have finished, and the last showing the difference between the two, ie showing hosts in which scans did not complete. I have to two easy queries complete, but can't seem to get the last one working:
1. host=* | top host limit=1000 | chart count
2. host=* "Writing report to /var/log/openvas/reports/report.xml" | chart count ]

Basically I want to show query 1 minus the results from query 2, so that I can see the hostnames of the boxes that are not completing the scan. I've tried diff and sub-searches with no luck, however I may have the syntax wrong. Any help would be hugely appreciated.

[somesoni2 · Accepted solution]

Try using this (validate the queries, both should have same columns)

|set diff [search host=* | top host limit=1000 | chart count] [search  host=* "Writing report to /var/log/openvas/reports/report.xml" | chart count ]

Updated:

try this

host=* NOT [search host=* "Writing report to /var/log/openvas/reports/report.xml" | stats count by host | fields - count] | chart count

[jpetrov]

I got it, just need to take off chart count

[jpetrov]

I added | top host limit=1000 | to just show the number of hosts and I am finally seeing the correct number. The only remaining issue is that I would like to see the hostnames listed out rather than just the count number, or at least be able to drill down from the count number to see the list of hosts.

Thanks again for the help!

[somesoni2]

My bad, let me know if the updated answer worked (or didn't work).

[jpetrov]

Thanks for the fast reply somesoni2,
This is not exactly what I am looking for. I basically need this panel to show all hosts that do not have the string "Writing report to /var/log/openvas/reports/report.xml" anywhere on them within the search time. I have tried host=* NOT "Writing report to /var/log/openvas/reports/report.xml", however this still shows all hosts, it just excludes that string.

I'm guessing there has to be an easy way to do this, I just haven't found it yet 🙂