How to write a search that has two conditions?

[samsingnok]

i have two conditions which has to be put in a same search.

conditon no 1:
if the Source address is in bad_ips.csv (lookup)
Number of Alerts received from IPS > 10 queries to DNS from same Source Address in 1 minute
Source Address are selected after comparing with the bad_ips look up .

Condition 2 :
if the source addresses are unknown,then
Number of Alerts received from IPS > 50 queries to DNS from same Source Address in 1 minute

kindly tell me about how to write the above conditions in the same search?
Index=ips (same for both)

Thanks in advance

[maciep]

As with some of your other posts, it's a bit hard to give you a search when you just give us the name of an index and the name of a lookup. Hopefully you understand that that is very little to go on.

So instead let's just talk about the process your search could use and then if you have more details you can share about the data, maybe we can help you actually write the search.

A couple questions. Are you planning to run this search over the past minute? Or do you want to run it over a longer period of time but do your evaluations in a minute interval? That will affect how the search is done.

1. Start with your base search, maybe just index=ips. But if there is some way to filter just the DNS queries up front, that's probably a good idea. In general, somewhere along the way that will need to happen, so I'm just going to assume it will be done here.
2. If running over a longer period of time, Pipe to the the bucket command and set your span to 1 minute for _time
3. Now pipe to stats to get a count by source address
4. Next lookup the source address in your lookup file, assuming it will output some new field to indicate whether it was found?
5. Now filter your events with where (based on the output field from previous step) to keep only those that have a count greater than 10 and in the badip list OR greater than 50 and not in the list
6. Then do whatever you want with the results...