stats,streamstats command question

[nnonm111]

I'm going to check the permission and rejection of the scan attack per hour.
At this point, what I wrote...
Which is appropriate, Vlaues or the list?
Also, which one is suitable, stats or stream stats?


index="firewall" (action="allow" OR action="deny" ) AND ( attack="*scan")
| bin _time span=1d
| stats count by _time,src_ip,dest_ip,app
| stats values(dest_ip) AS dest_ip , values(count) AS count by _time,src_ip,app
| table _time, src_ip ,app, dest_ip , count

[venkatasri]

@nnonm111  stats should work for your case changed span to 1h. 

index="firewall" (action="allow" OR action="deny" ) AND ( attack="*scan")
| bin _time span=1h
| stats count by _time,src_ip,dest_ip,app
| stats values(dest_ip) AS dest_ip , values(count) AS count by _time,src_ip,app
| table _time, src_ip ,app, dest_ip , count

[venkatasri]

instead of values(count) in second stats try sum(count)

[nnonm111]

thankyou 

I understand the difference between value and list is deduplication, which value will be removed?
Also, if you do list(app) and by app, the values are different.
What's the reason?

[venkatasri · Accepted solution]

index="firewall" (action="allow" OR action="deny" ) AND ( attack="*scan")
| bin _time span=1h
| stats count by _time,src_ip,dest_ip,app
| stats values(dest_ip) AS dest_ip , sum(count) AS count by _time,src_ip,app
| table _time, src_ip ,app, dest_ip , count

I have updated SPL, list() is an aggregation function it doesn't care of duplicates and by is clause for grouping.

[nnonm111]

index="firewall" (action="allow" OR action="deny" ) AND ( attack="*scan")
| bin _time span=1h
| stats count by _time,src_ip,dest_ip,app
| stats values(dest_ip) AS dest_ip , sum(count) AS count  by _time,src_ip,app
| table _time, src_ip ,app, dest_ip , count



index="firewall" (action="allow" OR action="deny" ) AND ( attack="*scan")
| bin _time span=1h
| stats count by _time,src_ip,dest_ip,app
| stats values(dest_ip) AS dest_ip , sum(count) AS count values(app) AS app by _time,src_ip
| table _time, src_ip ,app, dest_ip , count


What's the difference if the app changes?