- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
guidance on custom search
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-08-2023 01:53 PM
I'm trying to find some direction customizing a search string, but have not found the correct search phrase to help. I found a report (DNS Top Requested Domain Names) that is close to what I'm looking for. I would like to modify the search string behind this report to return all matching for domain names beginning with 'xyz' instead of the top requested domain names.
I think the highlighted section needs to be updated, but cannot find any information on the syntax to use.
index=ib_dns_summary report=si_dns_requested_domain | lookup dns_viewkey_displayname_lookup VIEW output display_name | stats sum(COUNT) as FQDN_TOTAL by FQDN | sort -FQDN_TOTAL | head 10 | eventstats sum(FQDN_TOTAL) as TOTAL | eval PERCENT=round(FQDN_TOTAL*100/TOTAL, 1) | eval PHOST=FQDN+" ("+PERCENT+"%)" | rename FQDN_TOTAL as Count, PHOST as "Domain Name" | fields "Domain Name", Count
Solved! Go to Solution.
Re: guidance on custom search
[ Edited ]- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-09-2023 09:32 PM - edited 03-09-2023 09:33 PM
Hey,
You can use the wildcard (*) search to filter out the domains starting with 'xyz'.
You can modify your search to include the FQDN.
index=ib_dns_summary report=si_dns_requested_domain FQDN="xyz*" | lookup......
'head 10' gives you top 10 in the list. if you want all the results you can remove this from the query.
Re: guidance on custom search
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-10-2023 07:28 AM
that was exactly what I was trying to get. Thanks.