Hi,
for some reason AND operator does not return the results, while OR operator does.
What is the way to get only the first result in the following table?
search:
(index=misp-events source="/var/scripts/events/*.json") (tag_name="misp-galaxy:continents=\"Asia\"" OR tag_name="misp-galaxy:targeted-region=\"Ukraine\"" OR tag_name="misp-galaxy:ransomware=\"*") | transaction source|table source,tag_name
Table:
Hi @bugnet,
The AND
does not work because the tag for the same source are not for the same event, they are for multiple events with the same source field. When using AND
a single event MUST match all the conditions.
In your case you have to use the OR
and the most efficient way to keep the one that matches all three conditions is as follows :
(index=misp-events source="/var/scripts/events/*.json") (tag_name="misp-galaxy:continents=\"Asia\"" OR tag_name="misp-galaxy:targeted-region=\"Ukraine\"" OR tag_name="misp-galaxy:ransomware=\"*") |stats dc(tag_name) as n_of_tags, values(tag_name) as tag_name by source |where n_of_tags >2
Cheers,
David
Hi @bugnet,
The AND
does not work because the tag for the same source are not for the same event, they are for multiple events with the same source field. When using AND
a single event MUST match all the conditions.
In your case you have to use the OR
and the most efficient way to keep the one that matches all three conditions is as follows :
(index=misp-events source="/var/scripts/events/*.json") (tag_name="misp-galaxy:continents=\"Asia\"" OR tag_name="misp-galaxy:targeted-region=\"Ukraine\"" OR tag_name="misp-galaxy:ransomware=\"*") |stats dc(tag_name) as n_of_tags, values(tag_name) as tag_name by source |where n_of_tags >2
Cheers,
David