Updating search for a better accuracy when doing an eval

[trevorQmulos]

I have the current search right now but am getting inaccurate numbers due to an issue with my search. I would like to rearrange the search so that I can sum the cvss_base_score instead of doing the division on every event and then summing all those values. I have tried to move the stats sum prior to the eval but then I get no results back from the search.

index=network sourcetype=nessus severity!=informational signature=Windows OR signature=Adobe OR signature=Java OR signature_family="Windows : Microsoft Bulletins" OR signature_family="Red Hat Local Security Checks" OR signature="Google Chrome*" OR signature="Firefox*" OR signature="MS*" OR signature="Flash Player*" OR signature="Solaris*"

| dedup dest_dns signature_id

| eventstats dc(dest_dns) as TotalDNS

| bin span=1mon _time

| eval PatchScore=cvss_base_score/TotalDNS

| stats sum(PatchScore) AS "Avg Host Patch Score" by _time

[sundareshr · Accepted solution]

Try this

index=network sourcetype=nessus severity!=informational signature=Windows OR signature=Adobe OR signature=Java OR signature_family="Windows : Microsoft Bulletins" OR signature_family="Red Hat Local Security Checks" OR signature="Google Chrome*" OR signature="Firefox*" OR signature="MS*" OR signature="Flash Player*" OR signature="Solaris*" 
| dedup dest_dns signature_id 
| eventstats dc(dest_dns) as TotalDNS 
| bin span=1mon _time 
| stats sum(cvss_base_score) as TotalScore max(TotalDNS) as TotalDNS by _time
| eval "Avg Host Patch Score"=TotalScore/TotalDNS 

[trevorQmulos]

Do you guys see a way to contain that number by the bin span or due to the eval needing to come after the sum or am I forced to use the highest distinct count?

[sundareshr]

Try moving the bin to before the eventstats and add a by _time to eventstats.

 index=network sourcetype=nessus severity!=informational signature=Windows OR signature=Adobe OR signature=Java OR signature_family="Windows : Microsoft Bulletins" OR signature_family="Red Hat Local Security Checks" OR signature="Google Chrome*" OR signature="Firefox*" OR signature="MS*" OR signature="Flash Player*" OR signature="Solaris*" 
 | dedup dest_dns signature_id 
 | bin span=1mon _time 
 | eventstats dc(dest_dns) as TotalDNS by _time
 | stats sum(cvss_base_score) as TotalScore max(TotalDNS) as TotalDNS by _time
 | eval "Avg Host Patch Score"=TotalScore/TotalDNS

[trevorQmulos]

Worked like a charm. Thanks again for the help.

Is there anyway for the MAX(dest_dns) to be specific to the month... for instance with the search, it will take that MAX and apply it to every month regardless of the max during that time frame so results are off for months where the number was low.

[somesoni2]

The field _time is not available after stats sum(cvss_base..... Did you miss by _time there?

[sundareshr]

Good catch. See updated.