Dashboards & Visualizations

How do I visualize changes to data from a sourcetype over time?

jambajuice
Communicator

I'm trying to make a dashboard to visualize nessus vulnerability data over time. For example, let's assume I run a vulnerability scan and get the following results (each line is a separate event):

results|192.168.1|192.168.1.100|epmap (135/tcp) results|192.168.1|192.168.1.100|netbios-ssn (139/tcp) results|192.168.1|192.168.1.100|rtsp (554/tcp) results|192.168.1|192.168.1.100|nessus (1241/tcp) results|192.168.1|192.168.1.100|http (8834/tcp)

Let's assume I disable nessus and the web server and the next time I scan I get the following results:

results|192.168.1|192.168.1.100|epmap (135/tcp) results|192.168.1|192.168.1.100|netbios-ssn (139/tcp) results|192.168.1|192.168.1.100|rtsp (554/tcp

If I want to create a chart that shows the number of results over time, how do I do that? How do I make the chart dynamically account for the fact that I may run the scan at variable time intervals (daily, weekly, monthly)?

Thanks.

Craig

Tags (1)
0 Karma

Ayn
Legend

Assuming you are producing nessus report files that are small enough that it takes Splunk less than a minute to index, and you're generating nessus reports less frequently than that interval, you should be able to use timechart for this purpose.

yoursearch | timechart span=1m count

You can feed this data into something like a line chart and configure it to connect non-null values.

0 Karma

Ayn
Legend

That's a bit trickier but can be done. Assuming you want to check the timestamp of the last event and then see all the other events in the preceding minute this search would work:

  • [yoursearch | head 1 | eval searchinterval=_time-60 | eval search="_time>" . searchinterval | fields search]
0 Karma

jambajuice
Communicator

Thanks!

What search do I need to use if I want to show all of the events with the most recent timestamp?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...