Hi,
I would like to get the top 3 wbrs blocked domains with a value below -6.2 prestented by each month for the last 12 months.
I have got the results that I want for the current month with the following line:
dest_domain!="-" action=block dest_domain="*" (x_wbrs_score<"-6.2") | top 3 dest_domain
Thanks by advance.
I don't have the same data but using the bucket command should get you what you are looking for.
Assume you have a custom time looking at the last 6 months or whatever (in months)
dest_domain!="-" action=block dest_domain="*" (x_wbrs_score<"-6.2") | bucket _time span=1mon | stats count(dest_domain) by dest_domain, _time | top 3 showperc=false dest_domain by _time
I don't have the same data but using the bucket command should get you what you are looking for.
Assume you have a custom time looking at the last 6 months or whatever (in months)
dest_domain!="-" action=block dest_domain="*" (x_wbrs_score<"-6.2") | bucket _time span=1mon | stats count(dest_domain) by dest_domain, _time | top 3 showperc=false dest_domain by _time
Thanks again! I changed the original syntax slightly and got the percentage numbers in relation to the overall blocked dest_domains for each month.
dest_domain!="-" action=block dest_domain="*" (x_wbrs_score<"-6.2" ) | bucket _time span=1month | top dest_domain by _time limit="3" showcount=false
Just take out the showperc=false and that will give you a percent value for each of the top 3. You can also use the 'useother=true' parameter and it will insert another row for each time bucket called OTHER that will show the percentage of the remaining data over that time.
| top 3 useother=true clientip by _time
Thanks for your reply! I get the requested information, I have a follow-up question based on what I get for the current month. How do I get the percentage of the top 3 destination domains in relation to the rest for each month?
Did that work for you?