How to create a query wit top notable event sources with HOSTNAME?

[tokio13]

Hello

Could someone help me with a query?

I have this default report Top Notable Event Sources which returns me IP's (count, sparkline etc). How can I add an extra column to have the hostname of those IP's? 

[tokio13]

Yes,  for that one

[Azeemering]

Then your answer is in my first reply 🙂

[tokio13]

It actually worked only if I mention the Indexer, but that looks to consume quite a lot of resources 

[Azeemering]

Hi,

You could just add the field host to the search. It will then show under Statistics.
This is for the Search "Notable - Top Notable Event Sources" in Enterprise Security if that is what you mean?

| `es_notable_events` | search timeDiff_type=current src!=unknown | stats sparkline(sum(count),30m) as sparkline,dc(rule_name) as correlation_search_count,dc(security_domain) as security_domain_count,sum(count) as count by src, host
| sort 100 - count,correlation_search_count