How to use Stats and Eval to count how many times "Microsoft" is included in the OS?

[mgubser]

I am reading nessus discovery scan logs and the way nessus formats their data is by separating fields by events. They run one test on an IP and get one result so for one IP they could have 30 events one having the Host Name, OS, Device type, etc.. When I use

Stats values(Computer_Name) values(Device_Type) values(Domain_Name) values(Device_FQDN) values(Device_HostName) values(MAC_Address) values(OS_Detected) values(Computer_Name) by Host 

I get all the fields I wanna see by Host(IP). I am unaware on how to search a specific stat to include a phrase as apposed to match it. If I do

|stats count(eval(OS_Detected=="Microsoft*")) AS Microsoft

I get a new field Microsoft that is all 0's

|stats count(eval(OS_Detected=="Microsoft Windows 7 Enterprise")) AS Microsoft

I get a 1 in that field for the ones that match

Thanks, Matt

[somesoni2 · Accepted solution]

Use it like this (your current stats 'count(eval(OS_Detected=="Microsoft*"))' doesn't treat "*" as wildcard but a regular character, hence 0 count)

|stats count(eval(like(OS_Detected,"Microsoft%")) AS Microsoft

[mgubser]

How could I search these stat fields? I am trying to search these fields in a drill down. The user can pick all or the name of the OS. I can't figure out how to. I am trying to do it something like this.

| search values(OS_Detected)=="$OS_Detected$"

If i just search OS_Detected=$OS_Detected$ I will not return the other events with other info. I am trying really hard to not use a join.