topic Chart count by 3 fields in Splunk Search

Chart count by 3 fields

DanielaEstera — Mon, 13 Sep 2021 19:18:31 GMT

Hello,

I am trying to build a chart based on 3 fields: 2 calculated fields and a simple one:

| query="select OPEN_FY, OPEN_QUARTER, CLOSURE_FY, VULNERABILITY_LIFECYCLE, SOURCE, LAYER
from table
| [evaluate] DETECTION_TIME=if((OPEN_FY="21/22" AND OPEN_QUARTER ="Q2"),"new" , "old")
| [evaluate] SOURCE=if((SOURCE!="QUALYS-P"), "Confirmed", "Potential")
| chart count(DETECTION_TIME) by SOURCE over(LAYER)

the last line won't work. I would need to see the total number of vulnerabilities by source by detection time and by layer.

Is that possible?

Thanks

Re: Chart count by 3 fields

ashvinpandey — Mon, 13 Sep 2021 20:13:07 GMT

@DanielaEstera Try using below command:
| chart count(DETECTION_TIME) as DETECTION_TIME over LAYER by SOURCE

Re: Chart count by 3 fields

DanielaEstera — Tue, 14 Sep 2021 06:44:43 GMT

Thank you so much @ashvinpandey That worked like a charm!

Re: Chart count by 3 fields

ashvinpandey — Thu, 16 Sep 2021 15:25:59 GMT

@DanielaEstera Also, If this solution helps you, an upvote would be appreciated.

Re: Chart count by 3 fields

DanielaEstera — Thu, 23 Sep 2021 12:18:49 GMT

Thank you, once again 😄

Re: Chart count by 3 fields

ashvinpandey — Thu, 23 Sep 2021 12:30:08 GMT

@DanielaEstera Please mark the solution so that this question can be marked as solved and others can directly look over it, thanks.