I'm currently trying to build a dashboard that would drill down by site name.
Here's an example of the site name: ABC-DEF-PRIV-APJ-AU-SYD.
So the drill-down would be APJ(Region)--> ABC(Business Unit) ---> assets
Could someone point me in the right direction to accomplish this?
Here's a snippet of the code and visualization that I'm getting:
index="lob_data" sourcetype="csv" sitename!="hec*" sitename!="corp*"
| where vulnAge > 30
| stats count(IP) as "Total Systems" by sitename,vulnAge
@payton_tayvion for the community to assist you better please provide more details on the data and your drilldown use case? Do you want to set three tokens from your site i.e. Region, Business Unit and Asset?
Also what it the breakup for site? In your example
ABC-DEF-PRIV-APJ-AU-SYD is first position
ABC always Business Unit? Is 4th position
APJ always region? Where is asset? What is position 2, 3, 5 and 6?
Seems like you need Simple XML
$row.site$ to set the required tokens. But we will not be able to assist you better without further details.
On a different note: Second
| where seems expensive. move
vulnAge to main search. Also for 10K+ results you want to use Pie Chart? Either switch to a different viz or use Trellis Layout.
yeah so right now I'm focusing on creating a regex that will pull
ABC which is the business unit, but when it pulls the business unit I only want it to pull for each business unit.
there may be multiple
ABC units but I only want it to show once on the pie chart