The following query is providing me what I need for PANs (each pillar is representing . However, I need to change the following query to get all (four PANS) in their own separate pillar, representing for last 8 days with each Pillar representing all for pans for each day.
index=pa* sourcetype=pan:threat (action=dropped OR action=blocked) src_ip!=10.* threat_id=* | stats count by dvc_name | sort count desc
Any assistance you can provide in that regard will be greatly appreciated.
(action=dropped OR action=blocked)
| (your code that assigns a Pillar/PAN value for each event)
| bin _time span=1d
| stats count as daycount by Pillar dvc_name _time
| appendpipe [| stats sum(daycount) as totalcount by Pillar |eval dvc_name="Totals"]
| sort 0 Pillar dvc_name _time
Many other ways are possible, depending on how you plan to use the report.
@cosm0630 please provide more details on the context like sample data, output what are you seeing and what you want. Is dvc_name PAN or Pillar. What is the other field in your data?
Last 8 days is for search or you want in Result as well?
Please provide more details for the community to help you better.