Splunk Search

issue with eval

rbw78
Communicator

Hello,

I'm trying to do an arithmetic operation between 2 values i get with a stats function.
I want to divide the number of cvss by the number of hosts.
Here is my serach.

sourcetype=nessus N_cvss>9 N_dnt=0 | rex "(?i)^(?:[^\t]*\t){2}(?P<host>[^\t]+)" | rex "(?i)^(?:[^\t]*\t){10}(?P<cvss>[^\t]+)" | stats dc(host) as nb_host | stats c(cvss) as nb_cvss | eval cvss_host=nb_cvss/nb_host

My values are correctly affected to fields nb_cvss and nb_host but when i use the eval function i have no result.
I also tried the "eventstats" in place of "stats" but the result is the same.

How could i get the result i want ?

Tags (2)
0 Karma

rbw78
Communicator

Well, something is wrong in my search.

I have the values nb_cvss and nb_cvss with also cvss_host in my final result.
I only want cvss_host in my final result for doing a chart on the which one i can his evolution of it for each months.

So i'm trying to use timechart but it doesn't work.

sourcetype=nessus N_cvss>9 N_dnt=0 | rex "(?i)^(?:[^\t]*\t){2}(?P<host>[^\t]+)" | rex "(?i)^(?:[^\t]*\t){10}(?P<cvss>[^\t]+)" | timechart span=1m eval(c(cvss) / dc(host))

it says my eval expression must be renamed but i don't know why, it should works ...

0 Karma

kristian_kolb
Ultra Champion

I don't really know if it affects the results, but you do not need two stats commands.
Does this produce the desired result?

sourcetype=nessus N_cvss>9 N_dnt=0 | rex "(?i)^(?:[^\t]*\t){2}(?P<host>[^\t]+)" | rex "(?i)^(?:[^\t]*\t){10}(?P<cvss>[^\t]+)" | stats dc(host) as nb_host c(cvss) as nb_cvss | eval cvss_host=nb_cvss/nb_host

/k

0 Karma

rbw78
Communicator

You resolved my issue, only one stats function is needed, thanks 🙂

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...