About inmanr

inmanr

Using the below sample search I'm trying to get every possible combination of results between two different sets of data and interested if there are any good techniques for doing so that are relatively efficient. At least with the production data set I'm working with it should translate to about 40,000 results. Below is just an example to make the data set easier to understand. Thank you in advance for any assistance. Sample search | makeresults | eval new_set="A,B,C" | makemv delim="," new_set | append [| makeresults | eval baseline="X,Y,Z" ] | makemv delim="," baseline Output should be roughly in the format below and I'm stuck on getting the data manipulated in a way that aligns with the below. new_set - baseline -- A-X A-Y A-Z B-X B-Y B-Z C-X C-Y C-Z

inmanr · ‎01-22-2019

Also noticing there is a problem in the props.conf with assigning the dest attribute in order to properly assign hostname values for use with the Malware Data Model in ES. If dhost has a value and shost doesn't, the logic in the original props.conf appears to overwrite dest with shost which is null. Added the following to local/props.conf which appears to have resolved it and left the default/props.conf alone. Perhaps this could be incorporated in the next release as well. Thanks [trendmicro] EVAL-dest = case((isnotnull(shost) AND isnull(dhost)),shost,(isnull(shost) AND isnotnull(dhost)),dhost)

Posts	2
Solutions	1
Karma Given	6
Karma Received	0
Member Since	‎12-23-2014

Online Status	Offline
Date Last Visited	Monday

Find all possible combinations with two different ...

Find all possible combinations with two different ...

Re: "trendmicro" stanza typo in props.conf EVAL-se...