topic Nessus data charting- How to make a trend chart of specific data set? in Splunk Search

Nessus data charting- How to make a trend chart of specific data set?

jenkinsta — Wed, 24 May 2023 14:17:40 GMT

I am making a trend chart of specific data set. What I am looking for is (generic example)

index=nessus | eval Month=strftime(firstSeen,"%b") | chart count by severity Month

So the end result would be Months on the X axis and the count of severity (critica,high,medium) for each month. Each month would have a count of each severity. But using the firstseeen date from the date event.

Re: Nessus data charting

yeahnah — Wed, 24 May 2023 01:19:31 GMT

Hi @jenkinsta

I think timechart would be better suited for this. Something like

index=nessus | timechart span=1month count BY severity

The counts are group by month then

Hope that helps

Re: Nessus data charting

jenkinsta — Wed, 24 May 2023 12:46:24 GMT

Thanks, I can do it by the time of the event but what I am looking for is by the firstSeen value from the event itself.

eval FirstSeenMonth=strftime(firstSeen,"%b")

How can I group by FirstSeenMonth or is there something else I need to do before I do any charting?