Hi, I am doing an analysis on malware infections in our company, more precisely per department. Working with total number of infections is not very representative, since one department may have more PCs than other departments. So I focus on the infection rate (Infected Assets / TotalAssets) I have a (more or less) stable list of PCs assigned to each department > assetinfo.csv. Asset, Department, Location PC1, Hr, Houston PC2, Finance, New York …and a temporary table (updated once a month) with the total count of assets by department > count_of_assets_by_department.csv. Department Count of Assets HR, 1000 Finance, 2500 I do have a working search that shows me the infection rate for each department (at least I think it works properly) | inputlookup count_of_assets_by_department.csv | appendcols [search index=infection | dedup shost | lookup assetinfo.csv Asset as shost OUTPUT Department | stats count as "InfectedAssets" by Department] | eval InfectionRate=(InfectedAssets/TotalAssets)*100 | table Department, TotalAssets, InfectedAssets, InfectionRate The problem: The search above is showing once-off results only. I would like to do trending (see below), but I do not know how to achieve this. Week 36 Week 37 Week 38 HR 2% 3% 4% Finance 5% 6% 3% Appreciate your support! ... View more

Hi, I have a field alert which contains the following events: “Failed Logon” “Dropped Database” However, sometimes the source application adds the string “Multiple - “ before it. Hence when running stats I end up with results like: “Failed Logon” 9 “Multiple - Failed Logon” 1 “Dropped Database” 2 “Multiple - Dropped Database” 3 I am looking for way to remove the string “Multiple - ” from the event field. The results should look like “Failed Logon” 10 “Dropped Database” 5 Appreciate your help! ... View more

Hi, I have a simple query that counts the number of virus infected machines by different departments. infection_status!=”infected” | stats count by department resulting in: HR – 10 IT – 2 FINANCE – 20 To achieve the above I have a lookup csv in place that links each machine name to a department. The csv looks sth. like this. PC-1 - HR PC-2 - IT PC-3 - FINANCE PC-4 – IT … I would like to put the count of infected assets in relation to the total number of known assets in each department. Hence I am looking for way to count the total number of known HR, IT, FINANCE machines (from the lookup csv) and use the results in my first query to get a infection rate, e.g. HR – 10/100 = 10% IT – 2/50 = 4% FINANCE – 20/150 = 13,3% ... View more