https://community.splunk.com/t5/Dashboards-Visualizations/A-chart-of-tstat-counts-of-the-content-that-was-bookmarked-for/m-p/692440#M56734 <P>I mean the content i have mapped in my mitre attack in the last 7 days.</P> Thu, 04 Jul 2024 19:59:41 GMT Amadou 2024-07-04T19:59:41Z https://community.splunk.com/t5/Dashboards-Visualizations/A-chart-of-tstat-counts-of-the-content-that-was-bookmarked-for/m-p/692436#M56732 <P><SPAN>Hello Can you help me Creating a dashboard that contains the following charts/data:</SPAN></P><P><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Bookmarked content</SPAN></P><OL><OL><LI><SPAN>A chart (of tstat/ counts) of the content that was bookmarked. for the past 7 days</SPAN></LI><LI><SPAN>A chart with the names of the alerts/detections that were bookmarked for the past 30 days&nbsp;&nbsp;</SPAN><SPAN>An</SPAN><SPAN>also in this situation how to find your filed name in your splunk: bookmarked, bookmark&nbsp;</SPAN><SPAN>I use both of them in my query but it still not working or we should use ''active'' please propose me a query.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; help me find the exact field name in order to create the exact query. Thank you.&nbsp;</SPAN></LI></OL></OL> Thu, 04 Jul 2024 19:44:35 GMT https://community.splunk.com/t5/Dashboards-Visualizations/A-chart-of-tstat-counts-of-the-content-that-was-bookmarked-for/m-p/692436#M56732 Amadou 2024-07-04T19:44:35Z https://community.splunk.com/t5/Dashboards-Visualizations/A-chart-of-tstat-counts-of-the-content-that-was-bookmarked-for/m-p/692439#M56733 <P>What is bookmarked data? Please share some anonymised, representative sample events showing the event data you are working with, and a representation of your expected results.</P> Thu, 04 Jul 2024 19:49:40 GMT https://community.splunk.com/t5/Dashboards-Visualizations/A-chart-of-tstat-counts-of-the-content-that-was-bookmarked-for/m-p/692439#M56733 ITWhisperer 2024-07-04T19:49:40Z https://community.splunk.com/t5/Dashboards-Visualizations/A-chart-of-tstat-counts-of-the-content-that-was-bookmarked-for/m-p/692440#M56734 <P>I mean the content i have mapped in my mitre attack in the last 7 days.</P> Thu, 04 Jul 2024 19:59:41 GMT https://community.splunk.com/t5/Dashboards-Visualizations/A-chart-of-tstat-counts-of-the-content-that-was-bookmarked-for/m-p/692440#M56734 Amadou 2024-07-04T19:59:41Z https://community.splunk.com/t5/Dashboards-Visualizations/A-chart-of-tstat-counts-of-the-content-that-was-bookmarked-for/m-p/692441#M56735 <P><SPAN>build a search query that captures the desired data. Assuming that the bookmarked content is logged with an event type or field that specifies when content is bookmarked (e.g.,&nbsp;</SPAN>action = "bookmark"<SPAN>), </SPAN></P> <P>&nbsp;</P> <P><SPAN>here's a query you could use:</SPAN></P> <P>&nbsp;</P> <LI-CODE lang="markup">| tstats count where index="your_index" sourcetype="your_sourcetype" action="bookmark" earliest=-7d@d latest=now by content | rename content as "Content", count as "Bookmark Count" </LI-CODE> <P><SPAN>but having problem to find the exact field name.</SPAN></P> Thu, 04 Jul 2024 21:15:55 GMT https://community.splunk.com/t5/Dashboards-Visualizations/A-chart-of-tstat-counts-of-the-content-that-was-bookmarked-for/m-p/692441#M56735 Amadou 2024-07-04T21:15:55Z https://community.splunk.com/t5/Dashboards-Visualizations/A-chart-of-tstat-counts-of-the-content-that-was-bookmarked-for/m-p/692442#M56736 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a></P><P>can i created a meeting with you tomorrow?</P><P>THANKS</P><P>&nbsp;</P> Thu, 04 Jul 2024 20:20:47 GMT https://community.splunk.com/t5/Dashboards-Visualizations/A-chart-of-tstat-counts-of-the-content-that-was-bookmarked-for/m-p/692442#M56736 Amadou 2024-07-04T20:20:47Z