I am attempting to get the latest status of a port scan for 5 different ports per host into a table.
I am trying to format it as follows:
time,host,hostname,port1,port2,port3,port4,port5
Currently, my search string looks like this:
(sourcetype=port_scan dst_port=443 | stats latest(dst_port_state) AS "port 443 state") OR (sourcetype=port_scan dst_port=80 | stats latest(dst_port_state) AS "port 80 state") and so on, but I am getting errors when running this search.
Any assistance would be greatly appreciated!
once you added your first "|" you cannot add further conditions. the parenthesis can only be used to group conditions not part of the search.
What you are trying to do is building subsearches ( using square brackets)
But in your case, it seems that the best solution is to use grouping per stats.
sourcetype=port_scan (dst_port=443 OR dst_port=80 ) | stats last(dst_port_state) AS "state" by dst_port
and remember that "last" means the oldest events. and "first" means the most recent events.
see http://answers.splunk.com/answers/42570/why-stats-last-and-first-are-inverted
To avoid confusion, you may want to use "earliest".
see http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/CommonStatsFunctions
once you added your first "|" you cannot add further conditions. the parenthesis can only be used to group conditions not part of the search.
What you are trying to do is building subsearches ( using square brackets)
But in your case, it seems that the best solution is to use grouping per stats.
sourcetype=port_scan (dst_port=443 OR dst_port=80 ) | stats last(dst_port_state) AS "state" by dst_port
and remember that "last" means the oldest events. and "first" means the most recent events.
see http://answers.splunk.com/answers/42570/why-stats-last-and-first-are-inverted
To avoid confusion, you may want to use "earliest".
see http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/CommonStatsFunctions