subsearch help

[mcbradford]

Not sure how to accomplish this....

First search:

index="airtight" message=quarantined eventtype="airtight_intrusion" NOT Agere | stats count by client_mac

If results are returned from first search, take the results "client_mac" and perform this search

sourcetype="nac" client_mac

display results

does this look correct?

sourcetype="nac" [search index="airtight" message=quarantined eventtype="airtight_intrusion" NOT Agere | return 100 client_mac] | stats count by client_mac, Users_Name, Company, _time

[dart]

I'd do
sourcetype="nac" [search index="airtight" message=quarantined eventtype="airtight_intrusion" NOT Agere | dedup client_mac| fields client_mac]

if you want to search for sourcetype=nac client_mac=XXX OR client_mac=YYY
or

sourcetype="nac" [search index="airtight" message=quarantined eventtype="airtight_intrusion" NOT Agere | dedup client_mac| format "" "" "" "" "OR" ""]

if you want to search sourcetype="nac" XXX OR YYY