Splunk Enterprise Security

Help creating a table that shows Incident Review Mean Time to Triage for each type of notable per notable owner

LionWolf
Explorer

Hello,

 

This is my first time seeking help in a forum, I apologize if my ask is confusing.

 

I'm looking to pull the metrics for each analyst based on the Mean time to triage each type of notable in the Incident Review dashboard. I need a table that shows the time it took for each analyst to put the status in "Ready for Review" after they put the status as "In Progress, the analyst name, & the notable name

 

This is a similar search to the one I have right now:

|`incident_review`

| rename status_label as status

| where status == "Ready for Review"

| sort - _time

| table status,rule_id,rule_name,owner_realname

| rename rule_id as "Notable ID"

| rename rule_name as Notable

| rename owner_realname as Analyst

| join type=left rule_id [ search notable | rename _time as notable_creation_time | convert ctime(notable_creation_time) 

| stats min(notable_creation_time) as notable_creation_time by rule_id]
Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this

|`incident_review`
| rename status_label as status
| eval reviewtime=if(status="Ready for Review",_time,null())
| eval inprogresstime=if(status="In Progress",_time,null())
| stats min(reviewtime) as reviewtime min(inprogresstime) as inprogresstime values(rule_name) as rule_name values(owner_realname) as real_name by rule_id
| rename rule_id as "Notable ID"
| rename rule_name as Notable
| rename owner_realname as Analyst
| eval timetoprocess=reviewtime-inprogresstime
| eval timetoprocess=tostring(timetoprocess,"duration")

View solution in original post

LionWolf
Explorer

Hello ITWhisperer,

If I were to change the time format to resemble something like HH:MM:SS then I think I would use the covert ctime() function in the timetoprocess variable correct? Or since it is pulling data from the reviewtime and the inprogresstime variables, would I have to convert those times as well?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this

|`incident_review`
| rename status_label as status
| eval reviewtime=if(status="Ready for Review",_time,null())
| eval inprogresstime=if(status="In Progress",_time,null())
| stats min(reviewtime) as reviewtime min(inprogresstime) as inprogresstime values(rule_name) as rule_name values(owner_realname) as real_name by rule_id
| rename rule_id as "Notable ID"
| rename rule_name as Notable
| rename owner_realname as Analyst
| eval timetoprocess=reviewtime-inprogresstime
| eval timetoprocess=tostring(timetoprocess,"duration")

LionWolf
Explorer

Hello ITWhisperer,

This table is amazing! Thank you so very much! 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...