Splunk Enterprise Security

how to make a bar graph showing quantity closed notable events based on last modified time in a time range of 12 hours?

grotti
Engager

I would like a search query that would display a graph with the number of closed notables divided by urgency in the last 12 hours, but the notables need to be retrieved based on the time they were closed.

I'm using this search:

| inputlookup append=T incident_review_lookup 
| rename user as reviewer 
| `get_realname(owner)` 
| `get_realname(reviewer)` 
| eval nullstatus=if(isnull(status),"true","false") 
| `get_reviewstatuses` 
| eval status=if((isnull(status) OR isnull(status_label)) AND nullstatus=="false",0,status) 
| eval status_label=if(isnull(status_label) AND nullstatus=="false","Unassigned",status_label) 
| eval status_description=if(isnull(status_description) AND nullstatus=="false","unknown",status_description) 
| eval _time=time 
| `uitime(time)` 
| fields - nullstatus

 

 

What's wrong?

0 Karma

meetmshah
Builder

Hello @grotti, If I understand the issue correctly, you are getting the expected results, but not for 12 hours. Is that right? If so, you can use "| addinfo" command as below - 

| inputlookup append=T incident_review_lookup
| addinfo
| where time>=info_min_time
| rename user as reviewer
| `get_realname(owner)`
| `get_realname(reviewer)`
| eval nullstatus=if(isnull(status),"true","false")
| `get_reviewstatuses`
| eval status=if((isnull(status) OR isnull(status_label)) AND nullstatus=="false",0,status)
| eval status_label=if(isnull(status_label) AND nullstatus=="false","Unassigned",status_label)
| eval status_description=if(isnull(status_description) AND nullstatus=="false","unknown",status_description)
| eval _time=time
| fields - nullstatus

It would give you the results based on whatever time range you are selecting from time range picker.

Please accept the solution and hit Karma, if this helps!

0 Karma

meetmshah
Builder

Hello, Just checking through if the issue was resolved or you have any further questions?

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...