topic Re: Stats issue with multivalue field in Splunk Search

Stats issue with multivalue field

mbasharat — Wed, 30 Sep 2020 04:42:03 GMT

Hi,

I am tracking my assets with vulnerabilities. My minimized sample query is:

index=vuln
| stats dc(dns) as impacted_asset_count by Vuln_ID, CVE

When stats populate, it shows that one vulnerability is affecting multiple assets and several Vuln_IDs have multiple CVEs.

Sample:

As you notice, there are multiple CVEs in some Vuln IDs. I need to have CVEs seperated/expanded/extracted as they are multivalue field and then have correct stats. Each CVE is impacting more than one assets so, I need it like this:

Thanks in-advance!!!

Re: Stats issue with multivalue field

to4kawa — Wed, 25 Mar 2020 06:48:32 GMT

index=vuln
| stats dc(dns) as impacted_asset_count values(Vuln_ID) as Vuln_ID by CVE

This is better.
by extracts multi values

Re: Stats issue with multivalue field

mbasharat — Wed, 25 Mar 2020 13:31:48 GMT

Hi @ to4kawa

This does not do it because cve is a multivalue field. AT minimum, it has one CVE and there are several vuln ids which have more than one CVE as shown in first screenshot. cves need to be extracted using regex or eval and then do stats will do it looks like. I will need regex or eval pls.

Re: Stats issue with multivalue field

mbasharat — Wed, 25 Mar 2020 16:20:59 GMT

I ended up using:

| makemv delim="," cve
| mvexpand cve

Re: Stats issue with multivalue field

to4kawa — Wed, 25 Mar 2020 20:56:33 GMT

I see, my answer is updated