topic Re: Append static data to a field for charting in Splunk Search

Append static data to a field for charting

zhatsispgx — Thu, 28 Feb 2019 23:51:50 GMT

Hello,

I am trying to append static data to a chart that splunk generates and i'm not sure how to do this with a lookup or anything. The end goal is to have additional x-axis entries (ProjectNames) on my chart with arbitrary values for Severity, alongside the actual real data found in our splunk index. Here is what it currently looks like:

index=myindex
| rename CxXMLResults.@ProjectName as ProjectName
| rename CxXMLResults.@Team as Team
| rename CxXMLResults.Query.Result.@Severity as Severity
| rename CxXMLResults.Query.Result.Path.@PathId as PathId
| eval deduper=md5(Team.ProjectName.PathId)
| dedup deduper
| fillnull value=''
| append [eval ProjectName="MyArbitraryProject"] 
| chart count(Team) over ProjectName by Severity

in the |append [eval ProjectName="MyArbitraryProject"] I Am trying to make a new project called "MyArbitraryProject" that will show up on the X axis, but obviously this doesn't work because I dont have Severity values available for it. Please help! I'm stumped.

Re: Append static data to a field for charting

HiroshiSatoh — Fri, 01 Mar 2019 00:54:17 GMT

Just want to add one row?

| append [| makeresults |eval ProjectName="MyArbitraryProject",Severity="your Severity"]
| chart count(Team) over ProjectName by Severity

Re: Append static data to a field for charting

zhatsispgx — Fri, 01 Mar 2019 16:06:11 GMT

This almost did what I need to.. the Count isn't showing up on the chart though. i.e.

index=checkmarx

CxXMLResults.Query.Result.@state!=1
CxXMLResults.Query.Result.@Severity!=Information
| rename CxXMLResults.@ProjectName as ProjectName
| rename CxXMLResults.@Team as Team
| rename CxXMLResults.Query.Result.@Severity as Severity
| rename CxXMLResults.Query.@name as VulnName
| rename CxXMLResults.Query.Result.Path.@PathId as PathId
| eval deduper=md5(Team.ProjectName.PathId)
| dedup deduper
| fillnull value=''
| append [| makeresults | eval ProjectName="MyArbitraryProject", Severity="High", count=500]
| chart count(Team) over ProjectName by Severity

Re: Append static data to a field for charting

somesoni2 — Fri, 01 Mar 2019 19:35:00 GMT

Give this a try

index=myindex
 | rename CxXMLResults.@ProjectName as ProjectName
 | rename CxXMLResults.@Team as Team
 | rename CxXMLResults.Query.Result.@Severity as Severity
 | rename CxXMLResults.Query.Result.Path.@PathId as PathId
 | eval deduper=md5(Team.ProjectName.PathId)
 | dedup deduper
 | fillnull value=''
 | chart count(Team) over ProjectName by Severity
 | fillnull value=0
 | append [| makeresults |eval ProjectName="MyArbitraryProject"]
 | fillnull value=500

Re: Append static data to a field for charting

zhatsispgx — Fri, 01 Mar 2019 21:02:44 GMT

Close. Once I discovered | makeresults thanks to @HiroshiSatoh I ended up with this that works

...
| dedup deduper
| fillnull value=''
| append [| makeresults count=1000 | eval ProjectName="MyArbitraryProject" | eval Team="MyTeam" | eval Severity="UNKNOWN" ] 
| chart count(Team) over ProjectName by Severity