https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-get-a-count-of-FieldA-per-FieldB-and/m-p/158372#M44611 <P>Good afternoon and happy monday! </P> <P>I'm working on trying to figure out a way to do the following :<BR /> Count of vulnerabilities per eventKey, per Application where the number of eventKeys is greater than 3. </P> <P>Basically, if a certain app has assessments performed more than 3 times and one of the vuln results is not 0, then we want to flag them as a security risk. </P> <P>What I have so far, which isn't working: </P> <PRE><CODE>search appname="*" eventtype="Complete" | dedup CompltdDate | stats dc(eventKey) by appname | eval vuln_count=+Vulnerabilities+" Outstanding Vulnerabilities - - - "+eventKey | stats values(vuln_count) AS Total_Vuln by appname APS_UAID | eval unique_vulns=mvcount(vuln_count) | sort = -unique_vuln </CODE></PRE> Mon, 10 Aug 2015 18:07:10 GMT antifreke 2015-08-10T18:07:10Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-get-a-count-of-FieldA-per-FieldB-and/m-p/158372#M44611 <P>Good afternoon and happy monday! </P> <P>I'm working on trying to figure out a way to do the following :<BR /> Count of vulnerabilities per eventKey, per Application where the number of eventKeys is greater than 3. </P> <P>Basically, if a certain app has assessments performed more than 3 times and one of the vuln results is not 0, then we want to flag them as a security risk. </P> <P>What I have so far, which isn't working: </P> <PRE><CODE>search appname="*" eventtype="Complete" | dedup CompltdDate | stats dc(eventKey) by appname | eval vuln_count=+Vulnerabilities+" Outstanding Vulnerabilities - - - "+eventKey | stats values(vuln_count) AS Total_Vuln by appname APS_UAID | eval unique_vulns=mvcount(vuln_count) | sort = -unique_vuln </CODE></PRE> Mon, 10 Aug 2015 18:07:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-get-a-count-of-FieldA-per-FieldB-and/m-p/158372#M44611 antifreke 2015-08-10T18:07:10Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-get-a-count-of-FieldA-per-FieldB-and/m-p/158373#M44612 <P>Give this a try</P> <PRE><CODE>search appname="*" eventtype="Complete" | dedup CompltdDate | stats count(Vulnerabilities) as Vulnerabilities by eventKey appname | eventstats dc(eventKey) as eventKeysCount by appname | where eventKeysCount&gt;3 </CODE></PRE> <P>Based on your current query, it's difficult to find out what all fields are available and useful for your requirement. Please provide what all fields are available in all events and define their values for better answer.</P> Mon, 10 Aug 2015 21:34:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-get-a-count-of-FieldA-per-FieldB-and/m-p/158373#M44612 somesoni2 2015-08-10T21:34:04Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-get-a-count-of-FieldA-per-FieldB-and/m-p/158374#M44613 <P>Here's what I have for the table, and what the data looks like </P> <P>APS_UAID | accessor | CompltdDate | ScanResult | Vulnerabilities | appname | eventKey | dataType</P> <P>001 | name 1 | 2015-03-04 17:51:00 | Failed | 16 | application A | 20150304Rescan | Pii,Pci,Whatever<BR /> 001 | name 1 | 2015-08-19 9:18:00 | Failed | 28 | application A | 20150819Rescan| Pii,Pci,Whatever<BR /> 001 | name 1 | 2014-11-22 14:30:00 | Failed | 71 | application A | 20141122Baseline| Pii,Pci,Whatever</P> <P>I would like to organize this like-</P> <P>appname | APS_UAID | Vulnerabilities per Assessment ID <BR /> name 1 | APS_3001 | 16 - 20150304Rescan<BR /><BR /> __________________________ | 28 - 20150819Rescan<BR /> __________________________ | 71 - 20141122Baseline</P> <P>| stats count by appname APS_UAID Vulnerabilities eventKey | eval vuln_count=+Vulnerabilities+" Outstanding Vulnerabilities - - - "+eventKey | stats values(vuln_count) AS "Total Vulnerabilties per Assessment ID" by appname APS_UAID | eval unique_vulns=mvcount(vuln_count) | sort by eventKey, appname</P> <P>That query will do that part of it, but it will show all of them. I need to only show more than 3 assessments where none of them = 0.</P> <P>If there are more than 3 scans completed per App and they are still vulnerabilities. This is how we plan to keep application owners accountable for patching and securing their internet facing applications.</P> Tue, 29 Sep 2020 06:58:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-get-a-count-of-FieldA-per-FieldB-and/m-p/158374#M44613 antifreke 2020-09-29T06:58:23Z