About stevesmith08

stevesmith08 · ‎05-28-2019

Thanks! it works correctly

stevesmith08 · ‎05-28-2019

If you explicitly specify the date in each subquery, the results they return differ in this field. I need to compare only fields “host”, “port”, “state”

stevesmith08 · ‎05-27-2019

Good day! I have two requests for different dates. I need to compare the results of the queries. The following comparison command works correctly: | set diff [search sourcetype=“scan_results” date=“2019-05-27” | table host, port, state] [search sourcetype=“scan_results” date=“2019-05-28” | table host, port, state] But I need to add a field “date” to each result. In the end, I want to track changes in the status of ports for different scan dates. Could you help me, please? Thanks

stevesmith08 · ‎05-16-2019

EventID = “ok” | timechart span=1h count(EventID) by Login Every hour I need to display only those values, where count(EventID)>5 I have used filter command (where) after timechart command but it didnt worked. Please help me! Thanks in advance!

stevesmith08 · ‎04-07-2019

Good day! I need to compare the results of a search query that contains multivalued fields. My search query looks like this: sourcetype = MySourceType earliest = 0 latest = now() | eval category = if(_time>relative_time(now(), "-2h@h"), "DeviceIDnew", "DeviceIDlater") | chart values(deviceID) by IP, category | eval compare = if(DeviceIDlater=DeviceIDnew, 0, 1) | table IP, DeviceIDlater, DeviceIDnew, compare Despite the fact that, in most cases, the comparison is correct, I noticed that in some cases there are errors. For example: In the example above, I mean that compare = 0 because the values DeviceIDnew contained in the field DeviceIDlater. Could you help me, please? How it is correct to compare multi-value field? Thank you!

stevesmith08 · ‎03-31-2019

Good day! Could you help me, please? I need to compare the number of unique user connections in two time intervals: 1) for all time; 2) for all time without the last hour. Now my search query looks like this, but it does not work correctly: sourcetype = * earliest = 1 latest = now() | stats count(DeviceID) as DeviceID_ALL by Login | appendcols [sourcetype = * earliest = 1 latest = -1h@h | stats count(DeviceID) as DeviceID_withoutlasthour by Login] | table Login, DeviceID_ALL, DeviceID_withoutlasthour If you can help me, I would be overly grateful. Thanks in advance!

stevesmith08 · ‎01-06-2019

Sorry, but what information do the “points” and “discipline” fields store? I may not have accurately put it, but the structure of each event is as follows: Surname = Smith, Math = 100, Physics = 65, History = 35, IT = 58, PE = 45 Surname = Wilson, Math = 67, Physics = 60, History = 90, IT = 72, PE = 50 ... But your way is really good for a bar chart on each subject individually 🙂

stevesmith08 · ‎01-06-2019

Hey, Could you please help me? Suppose I have events like this: Each event contains a student's assessment in five disciplines. The assessment is considered unsatisfactory if the student scored less than 50 points. You want to write a query that allows you to build a diagram of the following form: Thanks so much!

Posts	8
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎01-06-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

compare results in different days

How to filter results in timechart statistics tabl...

comparing multivalue fields

How do I compare search results from two different...

Could you help me build a bar chart?

Re: compare results in different days