Using Stats Average and Count to Display my Results

[Makinde]

Hi All,

I have a search string that reports three fields, Server name, Vulnerability and Severity (in numbers from 1 to 5).

So it is possible one server could have multiple vulnerability and each vulnerability has a severity in numbers

I would like to display my result by counting the number of times each server appears in my results which would mean that's the number of vulnerabilities found on that server, keep in mind each vulnerability found on that server has a severity, then I would like to do an average of all the severity for the vulnerabilities found on each server. so the result looks like

Server Name Count Average Severity
Server1 12 2.5
Server2 9 3.4
Server3 24 3.8

I have search strings that can generate Server_Name and Count and another one to generate Server Name and Average Severity but I need to know how to combine it so they can all be displayed in one table.

Here are the two different search strings;

index=main | stats count by Server_Name

index=main | stats avg(severity) by Server_Name

How can I get both search stirngs to become one and display both information correctly as described above?

[richgalloway · Accepted solution]

Combine the two stats commands into one.

index=main | stats count(severity) as Count avg(severity) as Average by Server_Name