Dashboards & Visualizations

Splunk stats command to get total count of existing field values in an additional new column

mbasharat
Contributor

I have an index that has vulnerabilities that are affecting hosts.

index=vulnerabilities

Fields in the index are:

host, VulnID, VulnName

I have a lookup name Assets. It has field name DNS. This field DNS is to be used as host in index's query. e.g.

index=vulnerabilities
| stats .........
| lookup Assets DNS AS host .....

I need a query that gives me attached image results with fast performance because I have a lot of affected hosts with a lot of vulnerabilities. I will be using this query to create a scheduled report so I can reference this report in my dashboard to create panels. My query will be looking at a few days back based on my scans:
alt text

Tags (1)
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

What about this: your current query | stats list(VulnID) as VulnID list(VulnName) as VulnName count(VulnID) by host

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

What about this: your current query | stats list(VulnID) as VulnID list(VulnName) as VulnName count(VulnID) by host

View solution in original post

0 Karma

mbasharat
Contributor

Hi @chrisyoungerjds,

With minor change, it all worked out. Instead of list, I used values and got desired output!! THANKS!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!