Dashboards & Visualizations

Splunk stats command to get total count of existing field values in an additional new column

mbasharat
Builder

I have an index that has vulnerabilities that are affecting hosts.

index=vulnerabilities

Fields in the index are:

host, VulnID, VulnName

I have a lookup name Assets. It has field name DNS. This field DNS is to be used as host in index's query. e.g.

index=vulnerabilities
| stats .........
| lookup Assets DNS AS host .....

I need a query that gives me attached image results with fast performance because I have a lot of affected hosts with a lot of vulnerabilities. I will be using this query to create a scheduled report so I can reference this report in my dashboard to create panels. My query will be looking at a few days back based on my scans:
alt text

Tags (1)
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

What about this: your current query | stats list(VulnID) as VulnID list(VulnName) as VulnName count(VulnID) by host

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

What about this: your current query | stats list(VulnID) as VulnID list(VulnName) as VulnName count(VulnID) by host

0 Karma

mbasharat
Builder

Hi @chrisyoungerjds,

With minor change, it all worked out. Instead of list, I used values and got desired output!! THANKS!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...