Splunk Search

How to use Stats and Eval to count how many times "Microsoft" is included in the OS?

mgubser
Explorer

I am reading nessus discovery scan logs and the way nessus formats their data is by separating fields by events. They run one test on an IP and get one result so for one IP they could have 30 events one having the Host Name, OS, Device type, etc.. When I use

Stats values(Computer_Name) values(Device_Type) values(Domain_Name) values(Device_FQDN) values(Device_HostName) values(MAC_Address) values(OS_Detected) values(Computer_Name) by Host 

I get all the fields I wanna see by Host(IP). I am unaware on how to search a specific stat to include a phrase as apposed to match it. If I do

|stats count(eval(OS_Detected=="Microsoft*")) AS Microsoft

I get a new field Microsoft that is all 0's

|stats count(eval(OS_Detected=="Microsoft Windows 7 Enterprise")) AS Microsoft

I get a 1 in that field for the ones that match

Thanks, Matt

Tags (3)
1 Solution

somesoni2
Revered Legend

Use it like this (your current stats 'count(eval(OS_Detected=="Microsoft*"))' doesn't treat "*" as wildcard but a regular character, hence 0 count)

|stats count(eval(like(OS_Detected,"Microsoft%")) AS Microsoft

View solution in original post

somesoni2
Revered Legend

Use it like this (your current stats 'count(eval(OS_Detected=="Microsoft*"))' doesn't treat "*" as wildcard but a regular character, hence 0 count)

|stats count(eval(like(OS_Detected,"Microsoft%")) AS Microsoft

mgubser
Explorer

How could I search these stat fields? I am trying to search these fields in a drill down. The user can pick all or the name of the OS. I can't figure out how to. I am trying to do it something like this.

| search values(OS_Detected)=="$OS_Detected$"

If i just search OS_Detected=$OS_Detected$ I will not return the other events with other info. I am trying really hard to not use a join.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>