How would I search multiple hosts with one search string? I have 6 hosts and want the results for all: Search String: index="rdpg" ( 2222222 dest_port="") OR (1111111 src_port="") OR ( 1111111 src_ip="") OR (2222222 dest_ip="") | eval disconnect_time=if(match(_raw,"2222222"),_time,null()) | eval connect_time=if(match(_raw,"1111111"),_time,null()) | eval Ephemeral=if(isnotnull(disconnect_time),dest_port,Ephemeral) | eval Ephemeral=if(isnotnull(connect_time),src_port,Ephemeral) | stats min(connect_time) as Connect max(disconnect_time) as Disconnect min(src_ip) as "Source IP" max(dest_ip) as "Destin ip" by Ephemeral | eval Seconds=Disconnect-Connect | fieldformat Seconds=strftime('Seconds', "%s") | eval "Total Time"=tostring(Seconds,"duration") | where Seconds > 300 | search Connect=* Disconnect=* | appendpipe [stats sum(Seconds) as "Total Seconds" ] | convert timeformat="%a %b-%d %Y "at" %H:%M:%S" ctime(Connect) ctime(Disconnect) Hosts= Srv004 Srv005 Srv181 Srv192 Srv142 Srv181 ... View more

I am trying to somehow get a total sum of the "Total Time" column and have it be on a separate line rather the next line because it adds totals of anything with a number. I found appendpipe to go to the next line. Search string: index="rdpg" ( 2222222 dest_port="") OR (1111111 src_port="") OR ( 1111111 src_ip="") OR (2222222 dest_ip="") | eval disconnect_time=if(match(_raw,"2222222"),_time,null()) | eval connect_time=if(match(_raw,"1111111"),_time,null()) | eval Ephemeral=if(isnotnull(disconnect_time),dest_port,Ephemeral) | eval Ephemeral=if(isnotnull(connect_time),src_port,Ephemeral) | stats min(connect_time) as Connect max(disconnect_time) as Disconnect min(src_ip) as "Source IP" max(dest_ip) as "Destin ip" by Ephemeral | eval Seconds=Disconnect-Connect | fieldformat Seconds=strftime('Seconds', "%s") | eval "Total Time"=tostring(Seconds,"duration") | where Seconds > 300 | search Connect=* Disconnect=* | appendpipe [stats sum(Seconds) as "Total Seconds" ] | convert timeformat="%a %b-%d %Y "at" %H:%M:%S" ctime(Connect) ctime(Disconnect) See results -=HERE=- ALSO: If I have a dashboard and I can get this total time thing working... can I somehow have a "button" that displays the total time based on a timeframe I specify? Here is my Dashboard and the "button" I'd like Example --The Red things 🙂 ... View more

I have an issue with calculating seconds that go over 60 minutes that sums to be a few days. One of my eval calculations sums to be 496089.166322 seconds and if I use |fieldformat "Total Time"=strftime('Total Time', "%M:%S") I get 48:09 as the sum but should calculate to 5 days, 17 hours, 48 minutes and 9 seconds I am not sure if I have to use a macro to do the job? LINK Or missing something obvious? I have searched through every variation of this and have tried all the common date and time format variables with strftime( converts epoch time to format Y ) Here is my current search string where I have to break down the Days Hours Minutes and Seconds along with a ScreenCapture Search String: index="snort" ( 2222222 dest_port="") OR (1111111 src_port="") OR ( 1111111 src_ip="") OR (2222222 dest_ip="") | eval disconnect_time=if(match(_raw,"2222222"),_time,null()) | eval connect_time=if(match(_raw,"1111111"),_time,null()) | eval Ephemeral=if(isnotnull(disconnect_time),dest_port,Ephemeral) | eval Ephemeral=if(isnotnull(connect_time),src_port,Ephemeral) | stats min(connect_time) as Connect max(disconnect_time) as Disconnect min(src_ip) as "Source IP" by Ephemeral | eval Seconds=Disconnect-Connect | fieldformat "Seconds"=strftime('Seconds', "%s") | eval Minutes=Seconds/60 | eval Hours=Minutes/60 | eval Days=Hours/24 | convert timeformat="%a %b-%d %Y "at" %H:%M:%S" ctime(Connect) ctime(Disconnect) | search Connect=* Disconnect=* | rename Ephemeral as "Connection Port", Total_time as "lala" ... View more

This is what I have ( 2222222 dest_port="*") OR (1111111 src_port="*") | eval disconnect_time=if(match(_raw,"2222222"),time,null()) | eval connect_time=if(match(_raw,"1111111"),time,null()) | eval Ephemeral=if(isnotnull(disconnect_time),dest_port,myPortField) | eval Ephemeral=if(isnotnull(connect_time),src_port,Ephemeral) | stats min(connect_time) as connect max(disconnect_time) as disconnect by Ephemeral Gives me -=THIS=- In Bold Black is what I'd like to have. Secondly, the "Ephemeral" ports, I'd like to have nulled/not show. ?? -They do not have a Connect & Disconnect time -"not associated" with anything else. --They are a snort signature false positive. Is this possible? I am in a huge jam at work where my job is on the line... 😞 ... View more