So I'm trying to chart blocked traffic(IPs) over 7 days... the purpose to help locate beaconing traffic (this has worked at a previous job but im taking it a step further by only wanting to see days with values.... example:
I would want to see results that only show, All days with values... Query works just see alot of days with 0 data
Here's my query:
index="pan_logs" sourcetype="pan:traffic" dest_zone="Public" src="10.11.16*" action=blocked
| chart count(dest) by dest date_wday
Give this a try
index="pan_logs" sourcetype="pan:traffic" dest_zone="Public" src="10.11.16*" action=blocked
| chart count(dest) by dest date_wday
| eval do_not_show=0
| foreach M* T* W* F* S* [| eval do_not_show= do_not_show+if('<<FIELD>>'==0,1,0)] | where do_not_show=0 | fields - do_not_show
Im still receiving 0 under days
Try this (accounting for case difference for field name)
index="pan_logs" sourcetype="pan:traffic" dest_zone="Public" src="10.11.16*" action=blocked
| chart count(dest) by dest date_wday
| eval do_not_show=0
| foreach M* m* T* t* W* w* F* f* S* s* [| eval do_not_show= do_not_show+if('<<FIELD>>'==0,1,0)] | where do_not_show=0 | fields - do_not_show
I received the same results... I may just try a different approach, i just feel like it shouldnt be this difficult
| untable dest date_wday count
| eventstats min(count) as minimum by dest
| where minimum>0
| xyseries dest date_wday count
that didnt produce any results
| makeresults
| eval _raw="Dest IP,Monday,Tuesday,Wed,Thurs,Friday
1.1.1.1,5,3,0,0,0
2.2.2.2,3,3,3,3,3"
| multikv forceheader=1
| table Dest_IP Monday Tuesday Wed Thurs Friday
| untable Dest_IP date_wday count
| eventstats min(count) as minimum by Dest_IP
| where minimum>0
| xyseries Dest_IP date_wday count
| foreach *
[| eval <<FIELD>>=if(<<FIELD>>=0,null(),<<FIELD>>)]
That didnt work, pretty much gave the same results, instead of 0 its giving a blank or NULL.
Is that not what you wanted?
No i would only want to see results that have values for all days, like example 2.2.2.2