Splunk Search

Adapting a search to use timechart

atenciodeyka
New Member

Hello:
I have the following search:

index=M sourcetype="n" name="M*" 
|dedup host-ip, plugin_name, plugin_family, severity, "ports{}.port", "ports{}.transport" | eval vulhost=if (severity="critical" or severity="high" or severity="medium" or severity="low",'host-ip',null())| stats dc(host-ip) as TH, dc(vulhost) as VH, first(date_month) as ETime, count(eval(severity="critical")) as VH1, count(eval(severity="high")) as VH2, count(eval(severity="medium")) as VH3, count(eval(severity="low")) as VH4, count | fillnull critical, high,medium,low,VH1,VH2,VH3,VH4
|eval RiskValueL=round((VH1+0.75*VH2+0.5*VH3+0.1*VH4)/(VH1+VH2+VH3+VH4)*(VH/TH),5)

I have to show a timechart with the RiskValue that is calculated in the search, however if I add the timechart at the end of the search, it shows nothing. How can I modify this search to be able to visualize a timechart of the RiskValue for the past 3 months for example?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Since you want to do timechart on calculated value after stats aggregation, you would need to do that aggregation for the time span you want to use in the timechart. E.g. If you want that RiskValueL to be calculated for every hour and show a timechart, you'd do something like this

index=M sourcetype="n" name="M*" 
 |dedup host-ip, plugin_name, plugin_family, severity, "ports{}.port", "ports{}.transport" | eval vulhost=if (severity="critical" or severity="high" or severity="medium" or severity="low",'host-ip',null()) 
| bucket span=1h _time
| stats dc(host-ip) as TH, dc(vulhost) as VH, first(date_month) as ETime, count(eval(severity="critical")) as VH1, count(eval(severity="high")) as VH2, count(eval(severity="medium")) as VH3, count(eval(severity="low")) as VH4, count by _time | fillnull critical, high,medium,low,VH1,VH2,VH3,VH4
 |eval RiskValueL=round((VH1+0.75*VH2+0.5*VH3+0.1*VH4)/(VH1+VH2+VH3+VH4)*(VH/TH),5)
| timechart span=1h avg(RiskValueL) as RiskValueL

Basically, bucket _time with 1hr spans before stats, add _time to stats and add timechart with same span.

View solution in original post

0 Karma

somesoni2
Revered Legend

Since you want to do timechart on calculated value after stats aggregation, you would need to do that aggregation for the time span you want to use in the timechart. E.g. If you want that RiskValueL to be calculated for every hour and show a timechart, you'd do something like this

index=M sourcetype="n" name="M*" 
 |dedup host-ip, plugin_name, plugin_family, severity, "ports{}.port", "ports{}.transport" | eval vulhost=if (severity="critical" or severity="high" or severity="medium" or severity="low",'host-ip',null()) 
| bucket span=1h _time
| stats dc(host-ip) as TH, dc(vulhost) as VH, first(date_month) as ETime, count(eval(severity="critical")) as VH1, count(eval(severity="high")) as VH2, count(eval(severity="medium")) as VH3, count(eval(severity="low")) as VH4, count by _time | fillnull critical, high,medium,low,VH1,VH2,VH3,VH4
 |eval RiskValueL=round((VH1+0.75*VH2+0.5*VH3+0.1*VH4)/(VH1+VH2+VH3+VH4)*(VH/TH),5)
| timechart span=1h avg(RiskValueL) as RiskValueL

Basically, bucket _time with 1hr spans before stats, add _time to stats and add timechart with same span.

0 Karma

adonio
Ultra Champion

the stats command takes the _time away ...
add by _time at the end of your stats and youll be fine

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...