https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328101#M97657 <P>Thanks for the answer, its missing an <CODE>)</CODE> to close the <CODE>stats count (eval</CODE>, at least now it presents the statistics tab, but the risk value is null, checking the values in every field I noticed that the VH (vulnerable hosts) field is 0 in every instance</P> <P>Edit: unless I'm missing something, the only condition to identify if a host is vulnerable it's if the severity is different from informational correct?</P> Fri, 02 Mar 2018 20:14:39 GMT ivan128 2018-03-02T20:14:39Z https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328093#M97649 <P>Hello, I have the following search that calculates a risk value with eval</P> <PRE><CODE>index=thing sourcetype=thing name=thing earliest=-60d latest=-7d|bucket _time span=1mon | dedup plugin_family plugin_name host-ip ports{}.port ports{}.protocol ports{}.transport | chart count by plugin_family,severity | stats sum(*) as *| join [search index=thing sourcetype=thing name=thing NOT severity=informational | dedup host-ip | chart count as "TOTAL VULNERABLES HOSTS"| stats values(TOTAL VULNERABLES HOSTS) as VH] | join [search index=thing sourcetype=thing name=thing | dedup host-ip | chart count as "TOTAL HOSTS" | stats values(TOTAL HOSTS) as TH]| fillnull critical, high,medium,low |eval RiskValue=/Formula/| timechart span=1mon max(RiskValue) </CODE></PRE> <P>VH,TH and RiskValue show the correct values when I checked them with <CODE>|fields TH,VH,RiskValue</CODE> but when I try to timechart the RiskValue it shows 0 results, I suspect its because timechart lacks timestamps to chart the risk values. I tried to use a bucket of 1 month and using span 1 mon in timechart but still there is no visualization. I searched through the forums but it seems every solution to charting an eval is specific to the search and I couldn't find any general rules or solutions that I could work from. Any help is appreciated, thanks.</P> Fri, 02 Mar 2018 17:21:55 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328093#M97649 ivan128 2018-03-02T17:21:55Z https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328094#M97650 <P>you need _time in order to do a timechart so I suspect you're losing your timestamp somewhere. If you add _time to your fields command are there values listed?</P> Fri, 02 Mar 2018 17:44:58 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328094#M97650 kmaron 2018-03-02T17:44:58Z https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328095#M97651 <P>yup, like @kmaron mentioned, you also lose the _time field whet using stats command</P> Fri, 02 Mar 2018 17:49:14 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328095#M97651 adonio 2018-03-02T17:49:14Z https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328096#M97652 <P>the _time field returns a null value, what @adonio mentioned seems to be the cause, is there a way to keep the _time when using stats?</P> Fri, 02 Mar 2018 18:16:55 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328096#M97652 ivan128 2018-03-02T18:16:55Z https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328097#M97653 <P>add by _time to the end of your stats</P> <PRE><CODE>| stats sum(*) as * by _time </CODE></PRE> Fri, 02 Mar 2018 18:18:49 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328097#M97653 kmaron 2018-03-02T18:18:49Z https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328098#M97654 <P>Tried it and didn't work, I also tried using evalstats insted of stats but to no avail.</P> <P>Edit: seems like I posted as answer instead of comment, apologies.</P> Fri, 02 Mar 2018 18:39:27 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328098#M97654 ivan128 2018-03-02T18:39:27Z https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328099#M97655 <P>I just noticed you have a chart AND a stats. the chart would be dropping the _time field as well. </P> Fri, 02 Mar 2018 18:42:13 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328099#M97655 kmaron 2018-03-02T18:42:13Z https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328100#M97656 <P>I think you have a lot more going on than is necessary, especially the joins and subsearches and chart/stats. I don't have a way to test this so I don't know if it's quite correct but I thin its close? </P> <PRE><CODE>index=thing sourcetype=thing name=thing earliest=-60d latest=-7d | bucket _time span=1mon | dedup host-ip plugin_family plugin_name host-ip ports{}.port ports{}.protocol ports{}.transport | stats count(eval(severity!=informational) as VH, dc(host-ip) as TH, count by plugin_family, severity, _time | fillnull critical, high,medium,low | eval RiskValue=/Formula/ | timechart span=1mon max(RiskValue) </CODE></PRE> Fri, 02 Mar 2018 19:01:39 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328100#M97656 kmaron 2018-03-02T19:01:39Z https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328101#M97657 <P>Thanks for the answer, its missing an <CODE>)</CODE> to close the <CODE>stats count (eval</CODE>, at least now it presents the statistics tab, but the risk value is null, checking the values in every field I noticed that the VH (vulnerable hosts) field is 0 in every instance</P> <P>Edit: unless I'm missing something, the only condition to identify if a host is vulnerable it's if the severity is different from informational correct?</P> Fri, 02 Mar 2018 20:14:39 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-the-Timechart-command-with-eval-result-returns-empty/m-p/328101#M97657 ivan128 2018-03-02T20:14:39Z