euroreg
Contributor
Contributor

Complex queries possible?

Hello,

i am just playing around fore a few days with LI. I am impress about the speed but i would like to use it for some security stuff and i cannot find any way to setup complex queries via the search window.

In Splunk such a query is possible. Can this achieved with LI?

| inputlookup event_id_4648_runas.csv  | convert mktime(_time) timeformat="%Y-%m-%dT%H:%M:%S.%3Q%z" | makemv Account_Name delim="," | bucket _time span=1d | stats count by _time Unprivileged_Account_Name

| eventstats max(_time) as maxtime | stats count as num_data_samples max(eval(if(_time >= relative_time(maxtime, "-1d@d"), 'count',null))) as "count" avg(eval(if(_time<relative_time(maxtime,"-1d@d"),'count',null))) as avg stdev(eval(if(_time<relative_time(maxtime,"-1d@d"),'count',null))) as stdev by "Unprivileged_Account_Name"

| eval lowerBound=(avg-stdev*2), upperBound=(avg+stdev*2)

| eval isOutlier=if(('count' < lowerBound OR 'count' > upperBound) AND num_data_samples >=7, 1, 0)

The input can be any data, in this example its a csv.

thanks for your reply.

kind regards

E.

0 Kudos
1 Reply
euroreg
Contributor
Contributor

Hello,

no one has an idea if something like this is possible? No one?

regards E.

0 Kudos