Building for the Splunk Platform

Why isn't the following chart query sorting by amount of threats?

Yaichael
Communicator

Good day,

I've have created the following query for displaying the amount of critical threats reported
by device, but it's only sorting by the Total field, and not by the amount of threats in every bar.

tag::critical sourcetype=syslog 
| chart count over device by threat limit=0 usenull=f useother=f
| addtotals
| sort -Total
| fields - Total
| head 5
| rename device as Devices

How do I achieve this?

Thanks!

Tags (1)
0 Karma

somesoni2
Revered Legend

Your chart shows count of each threat for each device reporting. Since not all threats are reported from all devices, if you sort by one threat, the sorting order will be different in other threat, so sorting by Total (which your query does) seems like better option. If that's not correct, could you please explain what's your expected output is, possible with some sample example.

0 Karma

Yaichael
Communicator

Thanks for the reply.

My query sorts by the total of threats for each device, which is on the x axis of the chart, but I would like to also sort by the total amount of each individual threat on those devices on the y axis.

0 Karma

somesoni2
Revered Legend

You basically want to order the column of each threat for each device based on count value for each threat. The problem is that they appear in the order of listing in the table visualization and listing order applies to all row. If you sort for each device, the column order will vary for each row hence that won't be possible.

See if something like this is acceptable:

 tag::critical sourcetype=syslog 
 | chart count over device by threat limit=0 usenull=f useother=f
 | addtotals
 | sort -Total
 | fields - Total
 | head 5
 | rename device as Devices
 | untable Devices threat count
 | eval Devices=Devices."-".threat | fields - threat
 | sort Devices -count
0 Karma

Yaichael
Communicator

Alright, if it isn't possible, I'll use your query.

Thank you!

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...