https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-my-VulnerabilityTitle-count-deltas-over-time-with/m-p/486592#M8028 <P>what's <CODE>x-axis</CODE> and <CODE>y-axis</CODE> ?</P> <P>maybe:</P> <PRE><CODE>... | fields - Count | xyseries import_timeday, VulnerabilityTitle, tops | sort 0 import_timeday </CODE></PRE> <P>Viz &gt;&gt; Line Chart</P> Tue, 05 May 2020 17:17:46 GMT to4kawa 2020-05-05T17:17:46Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-my-VulnerabilityTitle-count-deltas-over-time-with/m-p/486587#M8023 <P>Ok so bear with me as I explain. I would like to view my VulnerabilityTitle count deltas over time.</P> <P>So for instance, if I ran count by VulnerabilityTitle yesterday to get my top 10 most common vulnerabilities in my environment that is great. however, I need to be able to do that day after day using a time range. <BR />So, for instance, my top most common VulnerabilityTitle may drop down to my second most common VulnerabilityTitle after patching over the weekend. <BR />So my end goal is to be able to pick a time window and get VulnerabilityTitle counts Ranked for all the days in the time window I pick. That way I can see x vulnerability was rank 1 yesterday and is now rank 2 today.</P> <P>I am currently running this the search below which gives me most of what I want but it does not track the ranking over time. This ideally would not be only viewable in line graph format.</P> <PRE><CODE>| eval import_time=strftime(_time, "%Y-%m-%d:%H") | eval import_timeday=strftime(_time, "%Y-%m-%d") | eventstats latest(import_time) as Last by import_timeday | where Last = import_time | timechart span=1d count by VulnerabilityTitle where max in top10 useother=f </CODE></PRE> Sun, 07 Jun 2020 16:29:54 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-my-VulnerabilityTitle-count-deltas-over-time-with/m-p/486587#M8023 jlovik 2020-06-07T16:29:54Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-my-VulnerabilityTitle-count-deltas-over-time-with/m-p/486588#M8024 <PRE><CODE>| eval import_time=strftime(_time, "%Y-%m-%d:%H") | eval import_timeday=strftime(_time, "%Y-%m-%d") | eventstats latest(import_time) as Last by import_timeday | where Last = import_time | stats count as Count by import_timeday VulnerabilityTitle | sort 0 - Count | streamstats count as tops by import_timeday | where tops &lt; 11 </CODE></PRE> <P>Hi @jlovik<BR /> there is no details. this is quiz, I guess. please provide correct answer and result.</P> Mon, 04 May 2020 22:34:42 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-my-VulnerabilityTitle-count-deltas-over-time-with/m-p/486588#M8024 to4kawa 2020-05-04T22:34:42Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-my-VulnerabilityTitle-count-deltas-over-time-with/m-p/486589#M8025 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/218675">@magneto417x</a> This is not a quiz. It's a real world problem im working on. i am just very new to splunk. So if i wanted to rank these over time in a timechart (i know i previously asked for the opposite) how would i do that? This seems like it should work to me.</P> <P>| eval import_time=strftime(_time, "%Y-%m-%d:%H")<BR /> | eval import_timeday=strftime(_time, "%Y-%m-%d")<BR /> | eventstats latest(import_time) as Last by import_timeday<BR /> | where Last = import_time<BR /> | stats count as Count by import_timeday VulnerabilityTitle<BR /> | sort 0 - Count<BR /> | streamstats count as tops by import_timeday<BR /> | timechart span=1d count by VulnerabilityTitle where tops &lt; 11</P> Wed, 30 Sep 2020 05:13:00 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-my-VulnerabilityTitle-count-deltas-over-time-with/m-p/486589#M8025 jlovik 2020-09-30T05:13:00Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-my-VulnerabilityTitle-count-deltas-over-time-with/m-p/486590#M8026 <P>hi @jlovik</P> <P>For me, this is Quiz. there is no detail, no log, no sample, no result. I know nothing.<BR /> Can you create an SPL in this situation?</P> <P><CODE>| timechart span=1d count by VulnerabilityTitle where tops &lt; 11</CODE><BR /> Can this work? </P> <P>my query result:</P> <PRE><CODE>import_timeday, VulnerabilityTitle, Count, tops 2020-05-01, XXX, 100, 1 2020-05-01, YYY, 50, 2 .... </CODE></PRE> <P>Each <CODE>import_timeday</CODE> , <CODE>VulnerabilityTitle</CODE> should be in the top 10 in order of <CODE>Count</CODE>.<BR /> You don't need <CODE>timechart</CODE>. </P> Tue, 05 May 2020 16:50:35 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-my-VulnerabilityTitle-count-deltas-over-time-with/m-p/486590#M8026 to4kawa 2020-05-05T16:50:35Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-my-VulnerabilityTitle-count-deltas-over-time-with/m-p/486591#M8027 <P>your search works perfectly from above. i get the below all neatly aligned. it just doesn't seem to let me create a chart out of those fields after the | streamstats command. I would like to chart the tops 1-10 for each import_timeday for my search range in a line chart.</P> <P>timeday, VulnerabilityTitle, Count tops,<BR /> 2020-05-04, Weak LAN, 1<BR /> 2020-05-02, VM Ware, 1<BR /> 2020-05-05, tls, 1<BR /> 2020-05-01, micro, 1</P> Tue, 05 May 2020 17:00:44 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-my-VulnerabilityTitle-count-deltas-over-time-with/m-p/486591#M8027 jlovik 2020-05-05T17:00:44Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-my-VulnerabilityTitle-count-deltas-over-time-with/m-p/486592#M8028 <P>what's <CODE>x-axis</CODE> and <CODE>y-axis</CODE> ?</P> <P>maybe:</P> <PRE><CODE>... | fields - Count | xyseries import_timeday, VulnerabilityTitle, tops | sort 0 import_timeday </CODE></PRE> <P>Viz &gt;&gt; Line Chart</P> Tue, 05 May 2020 17:17:46 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-my-VulnerabilityTitle-count-deltas-over-time-with/m-p/486592#M8028 to4kawa 2020-05-05T17:17:46Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-my-VulnerabilityTitle-count-deltas-over-time-with/m-p/486593#M8029 <P>you are magic. thank you!</P> Tue, 05 May 2020 17:26:36 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-my-VulnerabilityTitle-count-deltas-over-time-with/m-p/486593#M8029 jlovik 2020-05-05T17:26:36Z