How do I get a count of Low, Medium, High, Critical in a Splunk Search?

[nrs011]

How do I get a count of Low, Medium, High, Critical in a Splunk Search?

This is the current search I am using:

`get_tenable_index` sourcetype="tenable:sc:vuln" severity=Low OR severity=Medium OR severity=High OR severity=Critical | dedup plugin_id, port, protocol, sc_uniqueness, source | eval key=plugin_id."_".port."_".protocol."_".sc_uniqueness."_".source | table severity, synopsis, solution, port, protocol, ip | outputlookup append=true key_field=key sc_vuln_data_lookup

[richgalloway]

Use the eventstats command to get a count.  The by option creates a separate count for each field value.

`get_tenable_index` sourcetype="tenable:sc:vuln" severity=Low OR severity=Medium OR severity=High OR severity=Critical 
| dedup plugin_id, port, protocol, sc_uniqueness, source 
| eval key=plugin_id."_".port."_".protocol."_".sc_uniqueness."_".source 
| eventstats count by severity
| table severity, synopsis, solution, port, protocol, ip 
| outputlookup append=true key_field=key sc_vuln_data_lookup