Dashboards & Visualizations

Splunk stats command to get total count of existing field values in an additional new column

mbasharat
Builder

I have an index that has vulnerabilities that are affecting hosts.

index=vulnerabilities

Fields in the index are:

host, VulnID, VulnName

I have a lookup name Assets. It has field name DNS. This field DNS is to be used as host in index's query. e.g.

index=vulnerabilities
| stats .........
| lookup Assets DNS AS host .....

I need a query that gives me attached image results with fast performance because I have a lot of affected hosts with a lot of vulnerabilities. I will be using this query to create a scheduled report so I can reference this report in my dashboard to create panels. My query will be looking at a few days back based on my scans:
alt text

Tags (1)
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

What about this: your current query | stats list(VulnID) as VulnID list(VulnName) as VulnName count(VulnID) by host

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

What about this: your current query | stats list(VulnID) as VulnID list(VulnName) as VulnName count(VulnID) by host

0 Karma

mbasharat
Builder

Hi @chrisyoungerjds,

With minor change, it all worked out. Instead of list, I used values and got desired output!! THANKS!

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...