How do I visualize changes to data from a sourcetype over time?

[jambajuice]

I'm trying to make a dashboard to visualize nessus vulnerability data over time. For example, let's assume I run a vulnerability scan and get the following results (each line is a separate event):

results|192.168.1|192.168.1.100|epmap (135/tcp) results|192.168.1|192.168.1.100|netbios-ssn (139/tcp) results|192.168.1|192.168.1.100|rtsp (554/tcp) results|192.168.1|192.168.1.100|nessus (1241/tcp) results|192.168.1|192.168.1.100|http (8834/tcp)

Let's assume I disable nessus and the web server and the next time I scan I get the following results:

results|192.168.1|192.168.1.100|epmap (135/tcp) results|192.168.1|192.168.1.100|netbios-ssn (139/tcp) results|192.168.1|192.168.1.100|rtsp (554/tcp

If I want to create a chart that shows the number of results over time, how do I do that? How do I make the chart dynamically account for the fact that I may run the scan at variable time intervals (daily, weekly, monthly)?

Thanks.

Craig

[Ayn]

Assuming you are producing nessus report files that are small enough that it takes Splunk less than a minute to index, and you're generating nessus reports less frequently than that interval, you should be able to use timechart for this purpose.

yoursearch | timechart span=1m count

You can feed this data into something like a line chart and configure it to connect non-null values.

[Ayn]

That's a bit trickier but can be done. Assuming you want to check the timestamp of the last event and then see all the other events in the preceding minute this search would work:

• [yoursearch | head 1 | eval searchinterval=_time-60 | eval search="_time>" . searchinterval | fields search]

[jambajuice]

Thanks!

What search do I need to use if I want to show all of the events with the most recent timestamp?