I am getting the relevant data from multiple events and combining it in stats by device. I created the dashboard I wanted but I am now working on the drill down. I am unsure how to search for a value in this stats table i have created. I need to be able to look for the exact string, any string, as well as no string. I am aware of using eval and like but that creates a field that returns 1 or 0 and seems too long and inefficient when searching for multiple fields on one search.
really just putting an answer here because it keeps popping up in a filter...
1) this hasn't anything to do with Add-on for Nessus
2) I believe this is the best answer http://blogs.splunk.com/2014/04/01/search-command-stats-eventstats-and-streamstats-2/ -- but it might be simpler to use a map or subsearch? The way I've learned is to gather all the data together in the leftmost portions of your search and then tabulate.
really just putting an answer here because it keeps popping up in a filter...
1) this hasn't anything to do with Add-on for Nessus
2) I believe this is the best answer http://blogs.splunk.com/2014/04/01/search-command-stats-eventstats-and-streamstats-2/ -- but it might be simpler to use a map or subsearch? The way I've learned is to gather all the data together in the leftmost portions of your search and then tabulate.