How to count hosts that have a field value of ((X OR Y) AND (A OR B)), over the course of time?

[stakor]

I am looking to find hosts that have two field values over the course of time for the search, for example a week.

That value has to be either X or Y, to count as a 'hit'. And at some other point in the time window, it also has to be A or B.

I am trying to display hosts that have at least two unique values for that field, that fall into BOTH of those clusters of values.

Example:
Host1 A
Host2 A
Host1 X
Host2 B

Host1 would be displayed, as it has a value for ((A OR B) AND (X OR Y))

Not sure how to pull that off yet.

[rjthibod · Accepted solution]

You can use search to do the filtering. The question is how do you want the final result displayed.

For example, if all you care about is just the individual values for the "host" field, then this should work (assume your special field is denoted as "MyField").

<YOUR_BASE_SEARCH> 
| stats values(MyField) as MyField by host 
| search (MyField=X OR MyField=Y) (MyField=A OR MyField=B) 
| fields host

[stakor]

Perfect. I was trying to get tricky and go down the wrong road, doing evals, etc. Just keep it simple.

Thank you.