Splunk Search

In Forescout, trying to pull the descriptions for each of the compliance types by hosts

tmaltizo
Path Finder

We have the following sourcetypes in index=forescout.
fs_av_compliance
fs_DLP_compliance
fs_fw_compliance
fs_encryption_compliance

They each have the field "description". How do I list each of the descriptions by host? I understand there may be multiple descriptions for any of the sourcetypes, but we can always dedup them....

Here's where I got stuck:

index=forescout (sourcetype=fs_av_compliance) OR (sourcetype=fs_DLP_compliance) OR (sourcetype=fs_fw_compliance) OR (sourcetype=fs_encryption_compliance) | fields src_nt_host description | chart values(description) over src_nt_host by sourcetype | table src_nt_host fs_av_compliance fs_DLP_compliance fs_fw_compliance fs_encryption_compliance

0 Karma
1 Solution

sundareshr
Legend

How about one of these

index=forescout (sourcetype=fs_av_compliance) OR (sourcetype=fs_DLP_compliance) OR (sourcetype=fs_fw_compliance) OR (sourcetype=fs_encryption_compliance) | fields src_nt_host description | stats values(description) as description by  src_nt_host sourcetype | mvexpand description

*OR*

index=forescout (sourcetype=fs_av_compliance) OR (sourcetype=fs_DLP_compliance) OR (sourcetype=fs_fw_compliance) OR (sourcetype=fs_encryption_compliance) | fields src_nt_host description | stats values(description) as description by  src_nt_host | mvexpand description

View solution in original post

0 Karma

sundareshr
Legend

How about one of these

index=forescout (sourcetype=fs_av_compliance) OR (sourcetype=fs_DLP_compliance) OR (sourcetype=fs_fw_compliance) OR (sourcetype=fs_encryption_compliance) | fields src_nt_host description | stats values(description) as description by  src_nt_host sourcetype | mvexpand description

*OR*

index=forescout (sourcetype=fs_av_compliance) OR (sourcetype=fs_DLP_compliance) OR (sourcetype=fs_fw_compliance) OR (sourcetype=fs_encryption_compliance) | fields src_nt_host description | stats values(description) as description by  src_nt_host | mvexpand description
0 Karma

tmaltizo
Path Finder

Thanks for your response @sundareshr!

How can I format the result so that the description falls under the appropriate sourcetype...

src_nt_host fs_av_compliance fs_DLP_compliance fs_fw_compliance fs_encryption_compliance
ABCD1234 AV running..... DLP installed... FW is up and running Encryption is running....

0 Karma

sundareshr
Legend

Like this

index=forescout (sourcetype=fs_av_compliance) OR (sourcetype=fs_DLP_compliance) OR (sourcetype=fs_fw_compliance) OR (sourcetype=fs_encryption_compliance) | chart values(description) over src_nt_host by sourcetype
0 Karma

tmaltizo
Path Finder

That's it! Thank you @sundareshr!

Can we go a step further and capture the latest description per sourcetype if there are more than one?

0 Karma

sundareshr
Legend

Try this

 index=forescout (sourcetype=fs_av_compliance) OR (sourcetype=fs_DLP_compliance) OR (sourcetype=fs_fw_compliance) OR (sourcetype=fs_encryption_compliance) | chart values(description) AS Descriptions latest(description) as Latest_Description over src_nt_host by sourcetype
0 Karma

tmaltizo
Path Finder

Thank you @sundareshr!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...