Perhaps I just need to check when more than 7 days have passed between one VA and the next. ... View more

I will explain my issue from the beginning to make it clearer. I have an index that contains vulnerabilities related to an IP, and on Splunk, I receive VA data every week. I would like to check based on my IP and vulnerabilities for different cases: Which vulnerabilities are new, i.e., those VA that appear only in the current week. Which vulnerabilities have reappeared in a week after being absent (I think I should check when a VA is missing for a week and then reappears, perhaps by looking at when the time between results is greater than 7 days). When a vulnerability has disappeared, i.e., when the last week in which we had that VA is not the same as the current one.** ... View more

  Here’s the translation of your text into English: "If I run this command: | eval year=substr(weeksum,1,4) the field remains empty, maybe because my field weeksum comes from an eventstats command: | eventstats values(week) as weeksum by IP,dest_ip,plugin_id and maybe the multivalue field is in a format that's not readable?" ... View more

"I will have a table composed of Hostname, Dev (hostname of the development machine associated with the machine in the Hostname field), vulnerability (vulnerability associated with the machine in Hostname). The Dev field is only used to see if the machine in Hostname has a machine in development associated with it. I should verify that in my table there is not that machine (in this case in the hostname field) associated with the same vulnerability." HOSTNAME DEV VULNERABILITà PAPERINO pippo APACHE In this case, my machine "paperino" has a vulnerability "apache", and it also has a development machine associated with it. Therefore, I should verify that for the machine "Pippo" there isn't the same vulnerability HOSTNAME DEV VULNERABILITà PIPPO - APACHE If this row were present in my search, then in the row of the table above, I should write "YES" in my new field that I will create. because pippo have same vulnerability (apache ) ... View more