topic Re: Updating search for a better accuracy when doing an eval in Splunk Search

Updating search for a better accuracy when doing an eval

trevorQmulos — Tue, 29 Sep 2020 10:51:41 GMT

I have the current search right now but am getting inaccurate numbers due to an issue with my search. I would like to rearrange the search so that I can sum the cvss_base_score instead of doing the division on every event and then summing all those values. I have tried to move the stats sum prior to the eval but then I get no results back from the search.

index=network sourcetype=nessus severity!=informational signature=Windows OR signature=Adobe OR signature=Java OR signature_family="Windows : Microsoft Bulletins" OR signature_family="Red Hat Local Security Checks" OR signature="Google Chrome*" OR signature="Firefox*" OR signature="MS*" OR signature="Flash Player*" OR signature="Solaris*"

| dedup dest_dns signature_id

| eventstats dc(dest_dns) as TotalDNS

| bin span=1mon _time

| eval PatchScore=cvss_base_score/TotalDNS

| stats sum(PatchScore) AS "Avg Host Patch Score" by _time

Re: Updating search for a better accuracy when doing an eval

sundareshr — Wed, 31 Aug 2016 15:21:09 GMT

Try this

index=network sourcetype=nessus severity!=informational signature=Windows OR signature=Adobe OR signature=Java OR signature_family="Windows : Microsoft Bulletins" OR signature_family="Red Hat Local Security Checks" OR signature="Google Chrome*" OR signature="Firefox*" OR signature="MS*" OR signature="Flash Player*" OR signature="Solaris*" 
| dedup dest_dns signature_id 
| eventstats dc(dest_dns) as TotalDNS 
| bin span=1mon _time 
| stats sum(cvss_base_score) as TotalScore max(TotalDNS) as TotalDNS by _time
| eval "Avg Host Patch Score"=TotalScore/TotalDNS

Re: Updating search for a better accuracy when doing an eval

somesoni2 — Tue, 29 Sep 2020 10:47:57 GMT

The field _time is not available after stats sum(cvss_base..... Did you miss by _time there?

Re: Updating search for a better accuracy when doing an eval

sundareshr — Wed, 31 Aug 2016 16:19:01 GMT

Good catch. See updated.

Re: Updating search for a better accuracy when doing an eval

trevorQmulos — Wed, 31 Aug 2016 16:56:34 GMT

Worked like a charm. Thanks again for the help.

Is there anyway for the MAX(dest_dns) to be specific to the month... for instance with the search, it will take that MAX and apply it to every month regardless of the max during that time frame so results are off for months where the number was low.

Re: Updating search for a better accuracy when doing an eval

trevorQmulos — Wed, 31 Aug 2016 18:12:33 GMT

Do you guys see a way to contain that number by the bin span or due to the eval needing to come after the sum or am I forced to use the highest distinct count?

Re: Updating search for a better accuracy when doing an eval

sundareshr — Wed, 31 Aug 2016 18:20:55 GMT

Try moving the bin to before the eventstats and add a by _time to eventstats.

 index=network sourcetype=nessus severity!=informational signature=Windows OR signature=Adobe OR signature=Java OR signature_family="Windows : Microsoft Bulletins" OR signature_family="Red Hat Local Security Checks" OR signature="Google Chrome*" OR signature="Firefox*" OR signature="MS*" OR signature="Flash Player*" OR signature="Solaris*" 
 | dedup dest_dns signature_id 
 | bin span=1mon _time 
 | eventstats dc(dest_dns) as TotalDNS by _time
 | stats sum(cvss_base_score) as TotalScore max(TotalDNS) as TotalDNS by _time
 | eval "Avg Host Patch Score"=TotalScore/TotalDNS