I have the following json output and im trying to acheieve (the title) however having issues getting it all grouped together.
i have tried the followed search but its not producing the desired output on the chart.
index=tmtesting | stats count by objects{}.product,objects{}.severity
JSON
"active": true,
"created": "2019-08-02T13:59:52.312976",
"cve": null,
"cwe": 89,
"date": "2019-08-01",
"description":"blablabla",
"duplicate": false,
"dynamic_finding": true,
"engagement": "Test",
"false_p": false,
"file_path": "Not Provided",
"hash_code": null,
"id": 1878,
"impact": "CIA Impact: PPP",
"is_Mitigated": false,
"is_template": false,
"last_reviewed": "2019-08-02T13:59:52.311132",
"line": null,
"line_number": null,
"mitigated": null,
"mitigation": "test",
"numerical_severity": "S1",
"out_of_scope": false,
"param": null,
"payload": null,
"product": "/api/v1/products/2/",
"references": "None",
"reporter": "/api/v1/users/1/",
"resource_uri": "www",
"scanner_confidence": null,
"severity": "High",
"severity_justification": null,
"sourcefile": "Not Provided",
"sourcefilepath": null,
"static_finding": true,
"steps_to_reproduce": null,
"test": "/api/v1/tests/13/",
"thread_id": 0,
"title": "title desc",
"under_defect_review": false,
"under_review": false,
"url": "N/A",
"verified": true
},
could you try ?
index=tmtesting
| rename objects{}.* as *
| chart count over product by severity
You may interchange product and severity however you want.
Also, try
index=tmtesting
| rename objects{}.* as *
| stats count by severity product
let me know if this helps!
could you try ?
index=tmtesting
| rename objects{}.* as *
| chart count over product by severity
You may interchange product and severity however you want.
Also, try
index=tmtesting
| rename objects{}.* as *
| stats count by severity product
let me know if this helps!