Splunk Enterprise

Need help showing statistics

akgreen
Loves-to-Learn Lots

index=VulnerabilityManagement Sourcetype=*
|fields dept=HR      vuln=*      PC=*
|I want statistics showing a list of  HRs vulnerabilities and the associated PC.

I'm new, hopefully this makes sense. I just want a basic statistics page that I can put on a dashboard showing the list of PC vulnerabilities in this dept. And remove any rows that are missing either the vulnerability or PC.

The statistics would show:

Vulnerabilities                            PC
CVE-Malware Boogy              CEOPC1234


Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share some sample events (in a code block </>) and indicate which fields have already been extracted?

0 Karma

akgreen
Loves-to-Learn Lots

I wish I could, but its work data 😕 But the fields above are the fields I am working with. 
The dept=hr gives me all of HR 
the vuln=give me all the vulnerabilities 
and the pc=gives me device name. 

I just don't know how to structure them and remove empty fields

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| where dept="HR" AND isnotnull(vuln) AND isnotnull(pc)
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...