How can I find computers that have been infected for three consecutive days?

[superhm]

I want to find the host IPs for three consecutive days of antivirus detection.
Please help me.
ex)
- sourcetype: virusalert

The names of the fields
- CLIENTIP
- VIRUSNAME
- TIME

[dineshraj9 · Accepted solution]

You can run a search for 3 days and do a distinct count based on date_mday(day of the month) -

sourcetype=virusalert | stats dc(date_mday) as count,max(TIME) as RECENT_ATTACK_TIME by CLIENTIP,VIRUSNAME | where count > 2 

[superhm]

Thank you for your advice!
I can get DATA what I want.

Here is my full query.

index=AV sourcetype=virusalert earliest=-4d@d latest=-1d@d
| eval REG_DATE=strftime(_time, "%Y-%m-%d")
| stats dc(date_mday) as count, max(REG_DATE) as RECENT_ATTACK_TIME by CLIENTIP, VIRUSNAME
| where count >2
| table RECENT_ATTACK_TIME, CLIENTIP, VIRUSNAME

Thanks again.