Hi All,
Cracking my head trying to get this to work.
Basically i need to add another column which will be "Count". Total count of all the hits per source to the URLs. Eg: Source A hits Google 10 times and Yahoo 12 times. So the url portion will show google & yahoo + a total count of 22.
Current search as below.
table src desc ResolvedDomain |dedup ResolvedDomain src| mvcombine ResolvedDomain|rename src as Source |rename dst as "Dst IP"| rename desc as "Description" | rename ResolvedDomain as URL
Can anyone point me in the right direction? what should i use?
Thanks
De
Give this a try
base search| table src desc ResolvedDomain
|stats count by src dst desc ResolvedDomain
| stats list(count) as count sum(count) as TotalCount list(ResolvedDomain) as URL by src dest desc
|rename src as Source dst as "Dst IP" desc as "Description"