Vulnerbilities Pie-chart on Dashboard (Qualys)

[NewSplunkUserX]

I am trying to create a real time pie-chart for vulnerable PC's in my environment.

I start with a simple query like:

index=qualys (STATUS=NEW OR RE-OPENED OR ACTIVE) | ...

However, most of the PC names start with same letters like IN, PH, etc. How to group them together in the pie-chart?

[niketn]

@NewSplunkUserX  try the following SPL

index=qualys (STATUS=NEW OR RE-OPENED OR ACTIVE) 
| stats count by NETBIOS
| eval GROUP=substr(NETBIOS,1,2)
| stats sum(count) as count by GROUP

[to4kawa]

sample:

index=_internal | head 100 | fields _time _raw | eval _raw="NETBIOS=".mvindex(split("AU,SN,TW,BK",","),random() % 4)."0".(random() % 9 + 1)."TTW "._time
| kv
| rename COMMENT as "this is sample. please check it. from here, the logic."
| rex field=NETBIOS "(?<group>\w\w)"
| stats count by group

recommend:

index=qualys (STATUS=NEW OR RE-OPENED OR ACTIVE) 
| rex field=NETBIOS "(?<group>\w\w)"
| stats count by group

please check sample code.

[niketn]

@to4kawa  Purpose for my stats first and field extract later was to reduce field extraction on number of events. A derivative of the following search optimization technique 🙂 : https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup#Optimizing_your_lookup_se...

[to4kawa]

please provide samples.

[NewSplunkUserX]

index=qualys (STATUS=NEW OR RE-OPENED OR ACTIVE) | stats count by NETBIOS

So all values starting with AU should make one part of the pie-chart. Similarly for others SN, TW, BK.

Output:

NETBIOS

AU09TTW

AU09TTW

SN09TTW

BK09TTW

BK09TTW

BK09TTW

SN09TTW

TW09TTW

TW09TTW

.

.

.