Yes, you are right. Second search is useless. index=nessus Risk=Medium earliest=-9d latest=now | stats values(CVE) as CVE_9d by extracted_Host | eval Status=case(isnull(CVE_9d) AND isnotnull(CVE...
See more...
Yes, you are right. Second search is useless. index=nessus Risk=Medium earliest=-9d latest=now | stats values(CVE) as CVE_9d by extracted_Host | eval Status=case(isnull(CVE_9d) AND isnotnull(CVE_now), "New",isnotnull(CVE_9d) AND isnull(CVE_now), "Finished", isnotnull(CVE_9d) AND isnotnull(CVE_now), "Not Changed") | table extracted_Host, Status My Problem is still here. I import vulnerability scans Logs into Splunk and get the Information about which Host has an open CVE and how high critical it is. I want the output if the scanned Host is in the old scan for 7 days and not in the new scan today and get the output that the Host is "Finished", same output for Host if is in the old scan and the new scan then i want the output "Unchanged", same output for Host when it is not in the old scan but in the new scan then i want the output "New" . I need the Information that i can build a Dashboard and see which Host and CVE are "done" , which one are "still open" and which Host and CVE are "New" because i must give the information/Ticket to the Server Admins. Thanks