I have a bunch of log files from a honeypot. In this logfiles, I have IP-Adresses which appear almost every day and some of them change. Now I'd like to see on a per week basis how many new IPs dropping in the pot.
Just to make my analysis problem clear
IPs in week 1
1.2.3.4
2.3.4.5
3.4.5.6
IPs in week 2
1.2.3.4
2.3.4.5
3.4.5.6
9.9.9.9
The result would be "1 IP added since last week"
You need to do a subsearch and use the boolean NOT to exclude those results.
source=mylogs src_ip=* NOT [ search earliest=-14d@d latest=-7d@d source=mylogs | stats count by src_ip | fields src_ip ] | stats dc(src_ip) as "New IP's this week"
If you are regularly doing this and have a lot of data, you might want to schedule the subsearch to speed this up.
edited to add the command "search" above and modify output
/me = newbie 🙂 Thx - now I got a result, I need to interpret it, wether it is what I want
he just forgot to put the search command. Add the word search before earliest. ie:
source=mylogs src_ip=* NOT [ search earliest=-14d@d latest=-7d@d .....
Thx for quick response, but unfortunately I got an error "Unknown search command 'earliest'". Perhaps I should have mentioned I used the free version 5.0.3?
use join to see the difference
Index=blah earliest=-1w@W|stats count as LastCount|join host[Index=blah earliest=-0w@W|stats count as Latest]|table host,LastCount,Latest|eval Difference=Latest-LastCount