So I'm working on a search that returns standard network stuff and using a bin to bucket the data by a day. Something like this:
base search earliest=-7d | bin _time span=1d as window | stats count(dest) as destination values(this) as this values(that) as that by ip window | where destination > 2
So this works but what I'm really interested in seeing are those ip values that exist in more than one window bin. I can't think of a way to break it down from what has effectively been the end of the search up to this point. Any ideas?
right after the bin command, you have a bunch of IP values each with a window value attached to it. You want to find those IP that are in two or more consecutive windows. My first approach to this would be to use transaction ip maxpause=1d . That would group all those events, that are consecutive and discard the rest.
Hope it helps