topic Re: Stats count on multiple fields in Reporting

How to achieve stats count on multiple fields?

mistydennis — Fri, 10 Feb 2023 20:31:04 GMT

Hi all - this one is hurting my brain. I need to pull two distinct numbers from my events: one with a total count of assets, and one with a total count of assets that contain a vulnerability.

What I think it should look like is not working:

| (stats dc(AssetNames) AS TotalExternalAssets, (dc(Asset_Names) AS TotalExposedAssets | where vulnerability!="missing"))

How do I get these two counts out of my events?

Re: Stats count on multiple fields

bowesmana — Fri, 10 Feb 2023 00:47:02 GMT

That command is not a valid Splunk command

What you probably want is

| stats dc(AssetNames) AS TotalExternalAssets dc(eval(if(vulnerability!="missing", AssetNames, null()))) AS TotalExposedAssets

I assume the AssetNames field is the same field (not Asset_Names in the second case)

This takes the count of unique assets (first dc()) and the second says

If the vulnerability is not missing, then count AssetNames, otherwise count NULL (this counts as 0)