I am reading nessus discovery scan logs and the way nessus formats their data is by separating fields by events. They run one test on an IP and get one result so for one IP they could have 30 events one having the Host Name, OS, Device type, etc.. When I use
Stats values(Computer_Name) values(Device_Type) values(Domain_Name) values(Device_FQDN) values(Device_HostName) values(MAC_Address) values(OS_Detected) values(Computer_Name) by Host
I get all the fields I wanna see by Host(IP). I am unaware on how to search a specific stat to include a phrase as apposed to match it. If I do
|stats count(eval(OS_Detected=="Microsoft*")) AS Microsoft
I get a new field Microsoft that is all 0's
|stats count(eval(OS_Detected=="Microsoft Windows 7 Enterprise")) AS Microsoft
I get a 1 in that field for the ones that match
Thanks, Matt
... View more