Hi All,
I'm trying to gain some visibility into whether scans are completing on all hosts, at the moment they are not and I would like to easily see which ones are not working properly. I want to have three panels. One showing all hosts, the next showing all hosts in which scans have finished, and the last showing the difference between the two, ie showing hosts in which scans did not complete. I have to two easy queries complete, but can't seem to get the last one working:
1. host=* | top host limit=1000 | chart count
2. host=* "Writing report to /var/log/openvas/reports/report.xml" | chart count ]
Basically I want to show query 1 minus the results from query 2, so that I can see the hostnames of the boxes that are not completing the scan. I've tried diff and sub-searches with no luck, however I may have the syntax wrong. Any help would be hugely appreciated.
... View more