index=VulnerabilityManagement Sourcetype=*
|fields dept=HR vuln=* PC=*
|I want statistics showing a list of HRs vulnerabilities and the associated PC.
I'm new, hopefully this makes sense. I just want a basic statistics page that I can put on a dashboard showing the list of PC vulnerabilities in this dept. And remove any rows that are missing either the vulnerability or PC.
The statistics would show:
Vulnerabilities PC
CVE-Malware Boogy CEOPC1234
Can you share some sample events (in a code block </>) and indicate which fields have already been extracted?
I wish I could, but its work data 😕 But the fields above are the fields I am working with.
The dept=hr gives me all of HR
the vuln=give me all the vulnerabilities
and the pc=gives me device name.
I just don't know how to structure them and remove empty fields
| where dept="HR" AND isnotnull(vuln) AND isnotnull(pc)