topic Re: Creating Dashboard/Tables in Dashboards & Visualizations

Creating Dashboard/Tables

chungmp — Thu, 05 Jun 2014 17:23:19 GMT

Thank you for coming by a few weeks ago.

I am trying to create Dashboard for failed login- however since we are getting data from multiple sources, i.e. syslog, CEF, etc.. we don’t have the same fields in the results.

For example- I am trying to create a table that display failed login results for all sshd processes (and they come from different type of sources- ie. Some may have suser field, some may not, and what I have realized is that the result will only display those with “src shost dvc dvchost suser duser msg”, where the fields are empty it will omit them. Hence I am missing events.

dproc=sshd categoryOutcome=/Fail*|top 20 categoryOutcome src shost dvc dvchost suser duser msg

I hope I make sense. Please let me know if you have any questions/what I need to change?

Re: Creating Dashboard/Tables

somesoni2 — Thu, 05 Jun 2014 18:15:51 GMT

Try something like this:
UPDATED

dproc=sshd categoryOutcome=/Fail* (categoryOutcome=* OR src=* OR shost=* OR dvc=* OR dvchost=* OR suser=* OR duser=* OR msg=*)| eval categoryOutcome=coalesce(categoryOutcome ,"NA") | eval  src=coalesce(src ,"NA")  | eval shost=coalesce(shost ,"NA")  | eval dvc=coalesce(dvc ,"NA")  | eval dvchost=coalesce(dvchost ,"NA")  | eval suser=coalesce(suser ,"NA")  | eval duser=coalesce(duser ,"NA")  | eval msg=coalesce(msg ,"NA") 
|top 20 categoryOutcome src shost dvc dvchost suser duser msg

 dproc=sshd categoryOutcome=/Fail* (categoryOutcome=* OR src=* OR shost=* OR dvc=* OR dvchost=* OR suser=* OR duser=* OR msg=*)| table categoryOutcome src shost dvc dvchost suser duser msg
| fillnull value="NA"
    |top 20 categoryOutcome src shost dvc dvchost suser duser msg

This will replace unavailable fields with values "NA", so that all events will get listed.

Give this a try

dproc=sshd categoryOutcome=/Fail* | eval shouldInclude=if(isnull(categoryOutcome) AND isnull(src) AND isnull(shost) AND isnull(dvc) AND isnull(dvchost) AND isnull(suser) AND isnull(duser) AND isnull(msg),"No","Yes") | where shouldInclude="Yes" | fillnull value="N/A" |top 20 categoryOutcome src shost dvc dvchost suser duser msg

Re: Creating Dashboard/Tables

chungmp — Thu, 05 Jun 2014 18:51:49 GMT

Thank you!!

There is a line w/ all N/A values, except for time- I added _time, which i believe is my own searches in splunk. How can I get rid of that?

Re: Creating Dashboard/Tables

somesoni2 — Thu, 05 Jun 2014 19:15:54 GMT

Try with updated answer.

Re: Creating Dashboard/Tables

chungmp — Thu, 05 Jun 2014 19:59:47 GMT

Thank you! I tried that and it works however, now I get a line with "" for all fields, except time column. I also tried:| fillnull value=("NA" OR "") but didn't help (please see below). Thanks!

dproc=sshd categoryOutcome=/Fail* (categoryOutcome=* OR src=* OR shost=* OR dvc=* OR dvchost=* OR suser=* OR duser=* OR msg=)| table categoryOutcome src shost dvc dvchost suser duser msg
| fillnull value=("NA" OR "")
|top 20 categoryOutcome src shost dvc dvchost suser duser msg

Re: Creating Dashboard/Tables

chungmp — Thu, 05 Jun 2014 20:00:10 GMT

Also, The results displays a row that says "NA" for all fields and one of them says "None", which I modified | fillnull value=("NA" OR "None"), but then I got missing results - i.e. some results disappeared that was there before if I just have | fillnull value="NA"

Re: Creating Dashboard/Tables

somesoni2 — Thu, 05 Jun 2014 20:06:06 GMT

How are you getting the _time column? I am not seeing that being used in your query.

Re: Creating Dashboard/Tables

chungmp — Mon, 09 Jun 2014 11:39:26 GMT

Yes, I did... I actually took out categoryOutcome and replaced with _time
dproc=sshd categoryOutcome=/Fail (src= OR shost= OR dvc= OR dvchost= OR suser= OR duser= OR msg=*)| table _time src shost dvc dvchost suser duser msg
| fillnull value=("NA" OR "")
|top 20 _time src shost dvc dvchost suser duser msg