Splunk Search

help on complex dynamic pie chart

jip31
Motivator

Hello

I use the search below in order to display datas in a pie chart
As you can see in my eval command, I agregate different services in order to disply them in a single name like "McAFEE" or "Windows native process".
My need is to be able to click on the on the "McAFEE" laber or the "Windows native process" label in order to display a new pie chart with the services in relation with this label
For McAFEE, its for example "mfev%", "mcdatrep", "mcshield", "amupdate", "McScript_InUse", "macompatsvc" , "FrameworkService" OR "McScanCheck"
Could you help me please??

`CPU` 
| fields process_cpu_used_percent host process_name 
| where process_cpu_used_percent>50 
| dedup host process_name 
| eval process_name=case(process_name like "mfev%" OR process_name like "mcdatrep" OR process_name=="mcshield" OR process_name=="amupdate" OR process_name=="McScript_InUse" OR process_name=="macompatsvc" OR process_name=="FrameworkService" OR process_name=="McScanCheck", "McAFEE", process_name like "Wmi%", "WMI", process_name=="conhost", "CMD Windows console", process_name=="csrss" OR process_name=="System" OR process_name=="TiWorker" OR process_name=="msfeedssync" OR process_name=="msiexec" OR process_name=="rundll32" OR process_name=="services" OR process_name like "svchost%" OR process_name=="OneDriveSetup" OR process_name=="poqexec" OR process_name=="unsecapp" OR process_name=="TabTip" OR process_name=="Memory_Compression" OR process_name=="SetupHost" OR process_name=="WerFault" OR process_name=="explorer" OR process_name=="mscorsvw" OR process_name=="sppsvc" OR process_name=="ngen" OR process_name=="spoolsv" OR process_name=="SrTasks" OR process_name=="policyHost" OR process_name=="dwm" OR process_name=="perf-test-9c" OR process_name like "SearchProtocolHost%" OR process_name like "RuntimeBroker%" OR process_name like "LogonUI%", "Windows native process", process_name=="taskhost", "Tasks scheduler")
| stats count(host) as Total by process_name 
| sort -Total
0 Karma
1 Solution

to4kawa
Ultra Champion

BASE SEARCH:

`CPU` 
| eval PROCESS=case(process_name like "mfev%" OR process_name like "mcdatrep" OR process_name=="mcshield" OR process_name=="amupdate" OR process_name=="McScript_InUse" OR process_name=="macompatsvc" OR process_name=="FrameworkService" OR process_name=="McScanCheck", "McAFEE", process_name like "Wmi%", "WMI", process_name=="conhost", "CMD Windows console", process_name=="csrss" OR process_name=="System" OR process_name=="TiWorker" OR process_name=="msfeedssync" OR process_name=="msiexec" OR process_name=="rundll32" OR process_name=="services" OR process_name like "svchost%" OR process_name=="OneDriveSetup" OR process_name=="poqexec" OR process_name=="unsecapp" OR process_name=="TabTip" OR process_name=="Memory_Compression" OR process_name=="SetupHost" OR process_name=="WerFault" OR process_name=="explorer" OR process_name=="mscorsvw" OR process_name=="sppsvc" OR process_name=="ngen" OR process_name=="spoolsv" OR process_name=="SrTasks" OR process_name=="policyHost" OR process_name=="dwm" OR process_name=="perf-test-9c" OR process_name like "SearchProtocolHost%" OR process_name like "RuntimeBroker%" OR process_name like "LogonUI%", "Windows native process", process_name=="taskhost", "Tasks scheduler") 

McAfee or Win:

| stats dc(eval(if(process_cpu_used_percent > 50,host,NULL))) as Total by PROCESS 

Process_selected:

| where PROCESS==$your_token|s$
| stats dc(eval(if(process_cpu_used_percent > 50,host,NULL))) as Total by process_name
| sort 0 - Total

I think it is easy to make three charts obediently.

View solution in original post

0 Karma

to4kawa
Ultra Champion

BASE SEARCH:

`CPU` 
| eval PROCESS=case(process_name like "mfev%" OR process_name like "mcdatrep" OR process_name=="mcshield" OR process_name=="amupdate" OR process_name=="McScript_InUse" OR process_name=="macompatsvc" OR process_name=="FrameworkService" OR process_name=="McScanCheck", "McAFEE", process_name like "Wmi%", "WMI", process_name=="conhost", "CMD Windows console", process_name=="csrss" OR process_name=="System" OR process_name=="TiWorker" OR process_name=="msfeedssync" OR process_name=="msiexec" OR process_name=="rundll32" OR process_name=="services" OR process_name like "svchost%" OR process_name=="OneDriveSetup" OR process_name=="poqexec" OR process_name=="unsecapp" OR process_name=="TabTip" OR process_name=="Memory_Compression" OR process_name=="SetupHost" OR process_name=="WerFault" OR process_name=="explorer" OR process_name=="mscorsvw" OR process_name=="sppsvc" OR process_name=="ngen" OR process_name=="spoolsv" OR process_name=="SrTasks" OR process_name=="policyHost" OR process_name=="dwm" OR process_name=="perf-test-9c" OR process_name like "SearchProtocolHost%" OR process_name like "RuntimeBroker%" OR process_name like "LogonUI%", "Windows native process", process_name=="taskhost", "Tasks scheduler") 

McAfee or Win:

| stats dc(eval(if(process_cpu_used_percent > 50,host,NULL))) as Total by PROCESS 

Process_selected:

| where PROCESS==$your_token|s$
| stats dc(eval(if(process_cpu_used_percent > 50,host,NULL))) as Total by process_name
| sort 0 - Total

I think it is easy to make three charts obediently.

0 Karma

jip31
Motivator

Thanks for your answer
If I well understand I have to replace my original search by your search?
More I dont understand | where PROCESS==$your_token|s$
Do I have to enter the name of the process here? Like McAFEE or Windows native process?

0 Karma

to4kawa
Ultra Champion

I thought you would make a dashboard, so I attached it to receive a drill-down token.
yes, you will put the PROCESS("McAFEE","Windows native process","Tasks scheduler")

0 Karma

jip31
Motivator

Sorry but I had a doubt 😉
so for summarize
1) I keep my search in the main dash
2) I create a drilldown with your search linked to my search? Do I have to add something in advanced parameters?
And are you sure that if I click on the McAFEE pie label from my search it will only open a pie chart with the McAFEE sub processes?
thanks

0 Karma

to4kawa
Ultra Champion

1 yes.
2 as you like.
Advanced parameters are not necessary.
When I created a dashboard on a trial basis, it was possible to drill down.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...