Splunk Search

Chart count by 3 fields

DanielaEstera
Explorer

Hello,

 

I am trying to build a chart based on 3 fields: 2 calculated fields and a simple one:

|  query="select OPEN_FY, OPEN_QUARTER, CLOSURE_FY, VULNERABILITY_LIFECYCLE, SOURCE, LAYER
from table
| [evaluate] DETECTION_TIME=if((OPEN_FY="21/22" AND OPEN_QUARTER ="Q2"),"new" , "old")
| [evaluate]  SOURCE=if((SOURCE!="QUALYS-P"), "Confirmed", "Potential")
| chart count(DETECTION_TIME) by SOURCE over(LAYER)

the last line won't work. I would need to see the total number of vulnerabilities by source by  detection time and by layer.

Is that possible?

Thanks

Labels (2)
0 Karma

DanielaEstera
Explorer

Thank you, once again 😄

0 Karma

ashvinpandey
Contributor

@DanielaEstera Please mark the solution so that this question can be marked as solved and others can directly look over it, thanks.

0 Karma

DanielaEstera
Explorer

Thank you so much @ashvinpandey  That worked like a charm! 

0 Karma

ashvinpandey
Contributor

@DanielaEstera Try using below command:
| chart count(DETECTION_TIME) as DETECTION_TIME over LAYER by SOURCE

ashvinpandey
Contributor

@DanielaEstera Also, If this solution helps you, an upvote would be appreciated.

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...