Open ports are check every 5 minutes.
index=os sourcetype=openPorts host=myhost earliest = -5m@m
udp 123
udp 1514
udp 1506
udp 1505
udp 1504
udp 1503
udp 1502
udp 1501
udp 514
udp 123
udp 123
udp 123
udp 631
tcp 8000
tcp 8089
tcp 22
tcp 9997
Is it possible to compare the most recent values with the previous results?
Something like this
|set diff [search index=os sourcetype=openPorts host=myhost earliest = -5m@m][index=os sourcetype=openPorts host=myhost earliest = -10m@m latest=-5m@m]
Add "|table <
There could be more better approach to this but you need to provide more details on the data, comparison you want to do to arrive on one.
It's work:
| set diff [ | search index=os sourcetype=openPorts host=host1 earliest = -5m@m | dedup Port | table Port][ | search index=os sourcetype=openPorts host=host2 earliest = -10m@m latest=-6m@m | dedup Port | table Port]
And I recieve: No results found.
The following step a cycle of all hosts. It is real? I don't want to write alert on each host separately.
Something like this
|set diff [search index=os sourcetype=openPorts host=myhost earliest = -5m@m][index=os sourcetype=openPorts host=myhost earliest = -10m@m latest=-5m@m]
Add "|table <
There could be more better approach to this but you need to provide more details on the data, comparison you want to do to arrive on one.
Thank you!