Splunk Search

Forescout: How to line graph month over month AV compliance counts by status description

tmaltizo
Path Finder

We have obtained counts for each status description using the following search.....

index="forescout" sourcetype="fs_av_compliance" description="Server*" | dedup src_nt_host | search status="non-compliant" | stats count by description | fields description, count

We'd like to create a line/area graph per status description with the count of hosts over time to determine if we're improving on av compliance over time.

Status descriptions:
Server AV Irresolvable
Server Antivirus Software is NOT installed
Server Corp AV is not installed
Server Symantec AV Running, But Defs older than 3 weeks
Server Symantec AV installed but Not Running
Server Symantec and McAfee AV Installed

Thanks in advance for your help!
Trista

0 Karma
1 Solution

sundareshr
Legend

Try this (feel free to adjust the span=1h)

index="forescout" sourcetype="fs_av_compliance" description="Server*" | dedup src_nt_host | search status="non-compliant" | timechart span=1h count by description

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/timechart

View solution in original post

0 Karma

sundareshr
Legend

Try this (feel free to adjust the span=1h)

index="forescout" sourcetype="fs_av_compliance" description="Server*" | dedup src_nt_host | search status="non-compliant" | timechart span=1h count by description

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/timechart

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...