Splunk Search

Chart count by 3 fields

DanielaEstera
Explorer

Hello,

 

I am trying to build a chart based on 3 fields: 2 calculated fields and a simple one:

|  query="select OPEN_FY, OPEN_QUARTER, CLOSURE_FY, VULNERABILITY_LIFECYCLE, SOURCE, LAYER
from table
| [evaluate] DETECTION_TIME=if((OPEN_FY="21/22" AND OPEN_QUARTER ="Q2"),"new" , "old")
| [evaluate]  SOURCE=if((SOURCE!="QUALYS-P"), "Confirmed", "Potential")
| chart count(DETECTION_TIME) by SOURCE over(LAYER)

the last line won't work. I would need to see the total number of vulnerabilities by source by  detection time and by layer.

Is that possible?

Thanks

Labels (2)
0 Karma

DanielaEstera
Explorer

Thank you, once again 😄

0 Karma

ashvinpandey
Contributor

@DanielaEstera Please mark the solution so that this question can be marked as solved and others can directly look over it, thanks.

0 Karma

DanielaEstera
Explorer

Thank you so much @ashvinpandey  That worked like a charm! 

0 Karma

ashvinpandey
Contributor

@DanielaEstera Try using below command:
| chart count(DETECTION_TIME) as DETECTION_TIME over LAYER by SOURCE

ashvinpandey
Contributor

@DanielaEstera Also, If this solution helps you, an upvote would be appreciated.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...