https://community.splunk.com/t5/Splunk-Search/In-Forescout-trying-to-pull-the-descriptions-for-each-of-the/m-p/235857#M70043 <P>Thank you @sundareshr!</P> Fri, 07 Oct 2016 14:24:19 GMT tmaltizo 2016-10-07T14:24:19Z https://community.splunk.com/t5/Splunk-Search/In-Forescout-trying-to-pull-the-descriptions-for-each-of-the/m-p/235851#M70037 <P>We have the following sourcetypes in index=forescout.<BR /> fs_av_compliance<BR /> fs_DLP_compliance<BR /> fs_fw_compliance<BR /> fs_encryption_compliance</P> <P>They each have the field "description". How do I list each of the descriptions by host? I understand there may be multiple descriptions for any of the sourcetypes, but we can always dedup them....</P> <P>Here's where I got stuck:</P> <P>index=forescout (sourcetype=fs_av_compliance) OR (sourcetype=fs_DLP_compliance) OR (sourcetype=fs_fw_compliance) OR (sourcetype=fs_encryption_compliance) | fields src_nt_host description | chart values(description) over src_nt_host by sourcetype | table src_nt_host fs_av_compliance fs_DLP_compliance fs_fw_compliance fs_encryption_compliance</P> Tue, 29 Sep 2020 11:18:40 GMT https://community.splunk.com/t5/Splunk-Search/In-Forescout-trying-to-pull-the-descriptions-for-each-of-the/m-p/235851#M70037 tmaltizo 2020-09-29T11:18:40Z https://community.splunk.com/t5/Splunk-Search/In-Forescout-trying-to-pull-the-descriptions-for-each-of-the/m-p/235852#M70038 <P>How about one of these</P> <PRE><CODE>index=forescout (sourcetype=fs_av_compliance) OR (sourcetype=fs_DLP_compliance) OR (sourcetype=fs_fw_compliance) OR (sourcetype=fs_encryption_compliance) | fields src_nt_host description | stats values(description) as description by src_nt_host sourcetype | mvexpand description </CODE></PRE> <P>*<STRONG><EM>OR</EM></STRONG>*</P> <PRE><CODE>index=forescout (sourcetype=fs_av_compliance) OR (sourcetype=fs_DLP_compliance) OR (sourcetype=fs_fw_compliance) OR (sourcetype=fs_encryption_compliance) | fields src_nt_host description | stats values(description) as description by src_nt_host | mvexpand description </CODE></PRE> Thu, 06 Oct 2016 19:06:58 GMT https://community.splunk.com/t5/Splunk-Search/In-Forescout-trying-to-pull-the-descriptions-for-each-of-the/m-p/235852#M70038 sundareshr 2016-10-06T19:06:58Z https://community.splunk.com/t5/Splunk-Search/In-Forescout-trying-to-pull-the-descriptions-for-each-of-the/m-p/235853#M70039 <P>Thanks for your response <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/140181">@sundareshr</a>!</P> <P>How can I format the result so that the description falls under the appropriate sourcetype...</P> <P>src_nt_host fs_av_compliance fs_DLP_compliance fs_fw_compliance fs_encryption_compliance<BR /> ABCD1234 AV running..... DLP installed... FW is up and running Encryption is running....</P> Tue, 29 Sep 2020 11:18:43 GMT https://community.splunk.com/t5/Splunk-Search/In-Forescout-trying-to-pull-the-descriptions-for-each-of-the/m-p/235853#M70039 tmaltizo 2020-09-29T11:18:43Z https://community.splunk.com/t5/Splunk-Search/In-Forescout-trying-to-pull-the-descriptions-for-each-of-the/m-p/235854#M70040 <P>Like this</P> <PRE><CODE>index=forescout (sourcetype=fs_av_compliance) OR (sourcetype=fs_DLP_compliance) OR (sourcetype=fs_fw_compliance) OR (sourcetype=fs_encryption_compliance) | chart values(description) over src_nt_host by sourcetype </CODE></PRE> Thu, 06 Oct 2016 19:51:55 GMT https://community.splunk.com/t5/Splunk-Search/In-Forescout-trying-to-pull-the-descriptions-for-each-of-the/m-p/235854#M70040 sundareshr 2016-10-06T19:51:55Z https://community.splunk.com/t5/Splunk-Search/In-Forescout-trying-to-pull-the-descriptions-for-each-of-the/m-p/235855#M70041 <P>That's it! Thank you @sundareshr!</P> <P>Can we go a step further and capture the latest description per sourcetype if there are more than one?</P> Thu, 06 Oct 2016 20:00:24 GMT https://community.splunk.com/t5/Splunk-Search/In-Forescout-trying-to-pull-the-descriptions-for-each-of-the/m-p/235855#M70041 tmaltizo 2016-10-06T20:00:24Z https://community.splunk.com/t5/Splunk-Search/In-Forescout-trying-to-pull-the-descriptions-for-each-of-the/m-p/235856#M70042 <P>Try this</P> <PRE><CODE> index=forescout (sourcetype=fs_av_compliance) OR (sourcetype=fs_DLP_compliance) OR (sourcetype=fs_fw_compliance) OR (sourcetype=fs_encryption_compliance) | chart values(description) AS Descriptions latest(description) as Latest_Description over src_nt_host by sourcetype </CODE></PRE> Thu, 06 Oct 2016 20:02:44 GMT https://community.splunk.com/t5/Splunk-Search/In-Forescout-trying-to-pull-the-descriptions-for-each-of-the/m-p/235856#M70042 sundareshr 2016-10-06T20:02:44Z https://community.splunk.com/t5/Splunk-Search/In-Forescout-trying-to-pull-the-descriptions-for-each-of-the/m-p/235857#M70043 <P>Thank you @sundareshr!</P> Fri, 07 Oct 2016 14:24:19 GMT https://community.splunk.com/t5/Splunk-Search/In-Forescout-trying-to-pull-the-descriptions-for-each-of-the/m-p/235857#M70043 tmaltizo 2016-10-07T14:24:19Z