How to search use stats count filter two fields?

[longmen]

Hi All,

I am doing a search for src_ip and DestAdd in a database within a 1 minute time frame. I need to look for src_ip which value that is not greater than 1 and DestAdd that is not greater than 5. Here is the description of the problem: when any of these with the same source IP more than 1 time, across more than 5 destination IP within 1 minutes. I wonder if my query correct. Can anyone advise? Thanks 

|bin span=1m _time |stats count(src_ip) as src_ip, count(DestAddress) as DestAddress by _time  |where (src_ip > 1 and DestAddress>5)

[yuanliu · Accepted solution]

One thing is not completely clear in your description.  Any src_ip that makes contact with "more than 5 destination IP within 1 minutes" must have appeared "more than 1 time" during the same minute.  Is there some additional constraint?

If there is no additional condition, you can use this search

| bin span=1m _time
| stats dc(DestAddress) as unique_dest by src_ip _time
| where unique_dest > 5

This is assuming that src_ip and DestAddress are present in the same event.  The question doesn't seem to make sense if an event only contains src_ip or DestAddress but not both, unless there is some other way to link src_ip and DestAddress.  If that is the case, you will need to analyze that link.