estdc usage

[Justin1224]

I have this snippet of a search query, and I have a question.

estdc(Purchase_History.Lavender_Paint) as Project1_count

Is estdc looking for the estimated count of the distinct values for Lavender_Paint within Purchase_History?

Thank you for your help

[somesoni2 · Accepted solution]

The Purchase_History.Lavender_Paint should be a field (hierarchical) in your search result. E.g. if your data is JSON OR XML, it Lavender_Paint field could be child of node Purchase_History.

[Justin1224]

Lastly, regarding the count that is being performed, is the count just a number? For example, if there were 75 attacks, would the IDS_Attacks.signature count just display 75, or would it display the name of each attack location?

[somesoni2]

It will just display the count (number). The dc(IDS_Attacks.signature) as attack_count will display count of unique values on the field signature, whereas just count will give total number of events (not distinct).

[Justin1224]

OK thank you for your help. I based that question off a query I'm working with and I was wondering if you could help me out with it.

Here is the query:

| tstats `summariesonly` dc(IDS_Attacks.signature) as attack_count,dc(IDS_Attacks.dest) as dest_count,count from datamodel=Intrusion_Detection by IDS_Attacks.src | `drop_dm_object_name("IDS_Attacks")` | sort - count

I'm trying to describe what that search query is doing. I made a description of it, could you let me know if my translation is correct? Here is it:

​Search and return the count of distinct values of the name of the intrusion detected on the client. Renames this count as "Attack Count". Search again and return the count of distinct values of the destination of the attack detected by the intrusion detection system (IDS). Rename this count as "dest count". Perform these counts from the datamodel that has the name "Intrusion Detection". Perform these counts by the source involved in the attacks. Sort the counts by descending order.

Please, any help would be very appreciated. Thank you

[somesoni2]

My description will be like this

From the Intrusion Dedection System (IDS) data, calculate the count of distinct attacks (distinct count of IDS_Attacks.signature field), count of distinct destinations and total number attack events, for each Attack source  (IDS_Attacks.src field). Rename the fields to remove prefix and sort in descending order of number of attack events.

[Justin1224]

That really helps thank you a lot!