How to add more fields to my table result in my search?

[nazanin2016]

Hi I am trying to find Malware activity detected on vulnerable systems so I did the subsearch as follow:

source="antivirus log" [search source="Vulnerability scanner.csv" |dedup IP,Vulnerability|rename IP as dest |table dest]|table dest Result_Status Attack_Name

It works correctly, but I was wondering how can I add more fields (not only the dest field that is common in both logs) from vulnerability scanner log to the final table, here as you see I can just table the fields that are in my Anti virus logs (dest Result_Status Attack_Name).

Thanks,

[somesoni2 · Accepted solution]

Give this a try

(source="antivirus log" [search source="Vulnerability scanner.csv" |stats count by IP|rename IP as dest |table dest] ) OR source="Vulnerability scanner.csv" | eval dest=coalesce(dest,IP) | stats dc(source) as sources values(Result_Status) as Result_Status values(Attack_Name) as Attack_Name values(Field1FromScannerlog) as Field1FromScannerlog values(Field1FromScannerlog) as Field1FromScannerlog... by dest | where sources=2 | fields - sources