https://community.splunk.com/t5/Splunk-Search/Forescout-How-to-line-graph-month-over-month-AV-compliance/m-p/242861#M72257 <P>Try this (feel free to adjust the <CODE>span=1h</CODE>)</P> <PRE><CODE>index="forescout" sourcetype="fs_av_compliance" description="Server*" | dedup src_nt_host | search status="non-compliant" | timechart span=1h count by description </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/timechart">http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/timechart</A></P> Tue, 11 Oct 2016 21:08:08 GMT sundareshr 2016-10-11T21:08:08Z https://community.splunk.com/t5/Splunk-Search/Forescout-How-to-line-graph-month-over-month-AV-compliance/m-p/242860#M72256 <P>We have obtained counts for each status description using the following search.....</P> <PRE><CODE>index="forescout" sourcetype="fs_av_compliance" description="Server*" | dedup src_nt_host | search status="non-compliant" | stats count by description | fields description, count </CODE></PRE> <P>We'd like to create a line/area graph per status description with the count of hosts over time to determine if we're improving on av compliance over time.</P> <P><STRONG>Status descriptions:</STRONG><BR /> Server AV Irresolvable<BR /> Server Antivirus Software is NOT installed<BR /> Server Corp AV is not installed<BR /> Server Symantec AV Running, But Defs older than 3 weeks<BR /> Server Symantec AV installed but Not Running<BR /> Server Symantec and McAfee AV Installed</P> <P>Thanks in advance for your help!<BR /> Trista</P> Tue, 11 Oct 2016 21:01:06 GMT https://community.splunk.com/t5/Splunk-Search/Forescout-How-to-line-graph-month-over-month-AV-compliance/m-p/242860#M72256 tmaltizo 2016-10-11T21:01:06Z https://community.splunk.com/t5/Splunk-Search/Forescout-How-to-line-graph-month-over-month-AV-compliance/m-p/242861#M72257 <P>Try this (feel free to adjust the <CODE>span=1h</CODE>)</P> <PRE><CODE>index="forescout" sourcetype="fs_av_compliance" description="Server*" | dedup src_nt_host | search status="non-compliant" | timechart span=1h count by description </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/timechart">http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/timechart</A></P> Tue, 11 Oct 2016 21:08:08 GMT https://community.splunk.com/t5/Splunk-Search/Forescout-How-to-line-graph-month-over-month-AV-compliance/m-p/242861#M72257 sundareshr 2016-10-11T21:08:08Z