Splunk Search

How can I find computers that have been infected for three consecutive days?

superhm
Explorer

I want to find the host IPs for three consecutive days of antivirus detection.
Please help me.
ex)
- sourcetype: virusalert

The names of the fields
- CLIENTIP
- VIRUSNAME
- TIME

Tags (1)
0 Karma
1 Solution

dineshraj9
Builder

You can run a search for 3 days and do a distinct count based on date_mday(day of the month) -

sourcetype=virusalert | stats dc(date_mday) as count,max(TIME) as RECENT_ATTACK_TIME by CLIENTIP,VIRUSNAME | where count > 2 

View solution in original post

0 Karma

dineshraj9
Builder

You can run a search for 3 days and do a distinct count based on date_mday(day of the month) -

sourcetype=virusalert | stats dc(date_mday) as count,max(TIME) as RECENT_ATTACK_TIME by CLIENTIP,VIRUSNAME | where count > 2 
0 Karma

superhm
Explorer

Thank you for your advice!
I can get DATA what I want.

Here is my full query.

index=AV sourcetype=virusalert earliest=-4d@d latest=-1d@d
| eval REG_DATE=strftime(_time, "%Y-%m-%d")
| stats dc(date_mday) as count, max(REG_DATE) as RECENT_ATTACK_TIME by CLIENTIP, VIRUSNAME
| where count >2
| table RECENT_ATTACK_TIME, CLIENTIP, VIRUSNAME

Thanks again.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...