Dashboards & Visualizations

I've got some information I'd like to turn into panels - am I going about this correctly?

New Member

Hi All,

I've been using the Splunk Add-on for Tenable to import the network scans from Nessus Professional. This part works great, searches are fine. I wanted to go to the next step and create a dashboard with all my critical vulnerabilities and how many IPs are affected.

I've managed to kludge together a query to get a nice looking table - but can't seem to take the next step into:

  1. Taking each signature and creating a panel out of it
  2. Get the number of IPs that are affected by said signature as a sigle value in the panel for the signature

Right now my query is

sourcetype="nessus" OR sourcetype="nessus:scan" (severity="critical") | stats values(signature) as signature by dest, severity

It comes out with a table

dest severity signature critical Apache 2.0.x < 2.0.48 Multiple Vulnerabilities (OF, Info Disc.)
PHP Unsupported Version Detection

Is this the best way to get to my requirement? Not sure how to integrate this into a panel.

Thanks for your help

0 Karma


The Save As dashboard panel on the RHS of the screen is how you can convert your search results into a dashboard panel

Perhaps you want to have a distinct count of the IP's by signature, dest, severity?

sourcetype="nessus" OR sourcetype="nessus:scan" (severity="critical") | stats dc(IP) by dest, severity, signature 

The above would assume your IP field is called "IP" and that you want it split by all three of those items...

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!