topic Re: Help with dashboard output in Dashboards & Visualizations

Help with dashboard output

troy44112 — Thu, 09 Jul 2020 16:46:56 GMT

How would I get from the first output to the final output?

First OutputFinaloutput

Re: Help with dashboard output

richgalloway — Thu, 09 Jul 2020 16:50:00 GMT

Please explain more about what you want to accomplish. The three events in the example are all at the same time so the concept of "first" and "last" are a bit ambiguous.

Re: Help with dashboard output

troy44112 — Thu, 09 Jul 2020 16:58:09 GMT

I would like to use the data in the first photo (dashboard ) to create the second photo (dashboard).

Re: Help with dashboard output

richgalloway — Thu, 09 Jul 2020 17:18:42 GMT

That much is plain. What is not clear, however, is the transition from the first photo to the last. How is Splunk to decide which events to display?

Re: Help with dashboard output

troy44112 — Thu, 09 Jul 2020 17:39:17 GMT

the code for the transition from the first to the last is what I am trying to accomplish.
Displaying systemName, ID total of High and Critical by systemName. I attempted to use eval split function and mvindex but couldn't quite figure it out.

Re: Help with dashboard output

richgalloway — Thu, 09 Jul 2020 18:33:32 GMT

I understand you are looking for code, but we can't provide code until we understand the problem. Can you explain in plain English how to transform the first photo into the last?
Can you please put the example query into a code block instead of an image so we can paste it into our own Splunk for testing?

Re: Help with dashboard output

troy44112 — Thu, 09 Jul 2020 18:40:50 GMT

I apologize. I don't know how to transform the first photo into the last. I was given the last photo as an example and I am attempting to turn the first photo into the last, that is the reason why I am here. I was hoping that someone would know what it would take to transform the first photo into the last. I do not have the code to do that.

here is the code to the first solution

Re: Help with dashboard output

richgalloway — Thu, 09 Jul 2020 19:50:07 GMT

It's not pretty and may not scale far, but this search converts your input into the desired output.

| makeresults | eval systemName="CE", ID="12345-MA-12345", severity="Critical", vulnCount=10 | append [| makeresults | eval systemName="CE", ID="12345-MA-12345", severity="High", vulnCount=5] | append [| makeresults | eval systemName="3E", ID="23456-MA-23456", severity="High", vulnCount=10] `comment("Above just creates test data")` | stats sum(vulnCount) as vulnCount by ID, systemName, severity `comment("The next two commands reduce the results to 3 fields for xyseries")` | eval sys=ID."/".systemName | fields sys, severity, vulnCount `comment("Re-format the results")` | xyseries sys severity vulnCount | fillnull value=0 `comment("The next 2 commands restore the original field names")` | eval sys=split(sys,"/") | eval ID=mvindex(sys,0), systemName=mvindex(sys,1) | table systemName, ID, High, Critical

Re: Help with dashboard output

troy44112 — Mon, 13 Jul 2020 18:45:52 GMT

thank you very much

Re: Help with dashboard output

richgalloway — Mon, 13 Jul 2020 19:17:40 GMT

If your problem is resolved, then please click an "Accept as Solution" button to help future readers.