Stats issue with multivalue field

[mbasharat]

Hi,

I am tracking my assets with vulnerabilities. My minimized sample query is:

index=vuln
| stats dc(dns) as impacted_asset_count by Vuln_ID, CVE

When stats populate, it shows that one vulnerability is affecting multiple assets and several Vuln_IDs have multiple CVEs.

Sample:

As you notice, there are multiple CVEs in some Vuln IDs. I need to have CVEs seperated/expanded/extracted as they are multivalue field and then have correct stats. Each CVE is impacting more than one assets so, I need it like this:

Thanks in-advance!!!

[mbasharat · Accepted solution]

I ended up using:

| makemv delim="," cve
| mvexpand cve

[to4kawa]

index=vuln
| stats dc(dns) as impacted_asset_count values(Vuln_ID) as Vuln_ID by CVE

This is better.
by extracts multi values

[mbasharat]

Hi @ to4kawa

This does not do it because cve is a multivalue field. AT minimum, it has one CVE and there are several vuln ids which have more than one CVE as shown in first screenshot. cves need to be extracted using regex or eval and then do stats will do it looks like. I will need regex or eval pls.

[to4kawa]

I see, my answer is updated