How do I get a count of Low, Medium, High, Critical in a Splunk Search?
This is the current search I am using:
`get_tenable_index` sourcetype="tenable:sc:vuln" severity=Low OR severity=Medium OR severity=High OR severity=Critical | dedup plugin_id, port, protocol, sc_uniqueness, source | eval key=plugin_id."_".port."_".protocol."_".sc_uniqueness."_".source | table severity, synopsis, solution, port, protocol, ip | outputlookup append=true key_field=key sc_vuln_data_lookup
Use the eventstats command to get a count. The by option creates a separate count for each field value.
`get_tenable_index` sourcetype="tenable:sc:vuln" severity=Low OR severity=Medium OR severity=High OR severity=Critical
| dedup plugin_id, port, protocol, sc_uniqueness, source
| eval key=plugin_id."_".port."_".protocol."_".sc_uniqueness."_".source
| eventstats count by severity
| table severity, synopsis, solution, port, protocol, ip
| outputlookup append=true key_field=key sc_vuln_data_lookup