Reporting

How to achieve stats count on multiple fields?

mistydennis
Communicator

Hi all - this one is hurting my brain. I need to pull two distinct numbers from my events: one with a total count of assets, and one with a total count of assets that contain a vulnerability.

What I think it should look like is not working:

 

 

| (stats dc(AssetNames) AS TotalExternalAssets, (dc(Asset_Names) AS TotalExposedAssets | where vulnerability!="missing"))

 

 

 

How do I get these two counts out of my events?

0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

That command is not a valid Splunk command

What you probably want is

| stats dc(AssetNames) AS TotalExternalAssets
        dc(eval(if(vulnerability!="missing", AssetNames, null()))) AS TotalExposedAssets

I assume the AssetNames field is the same field (not Asset_Names in the second case)

This takes the count of unique assets (first dc()) and the second says 

  • If the vulnerability is not missing, then count AssetNames, otherwise count NULL (this counts as 0)

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

That command is not a valid Splunk command

What you probably want is

| stats dc(AssetNames) AS TotalExternalAssets
        dc(eval(if(vulnerability!="missing", AssetNames, null()))) AS TotalExposedAssets

I assume the AssetNames field is the same field (not Asset_Names in the second case)

This takes the count of unique assets (first dc()) and the second says 

  • If the vulnerability is not missing, then count AssetNames, otherwise count NULL (this counts as 0)

 

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...