| inputlookup scanner_visibility.csv | lookup visibility_blue.csv Acronym AS application local=t OUTPUTNEW "Risk Score" | lookup server_dump.csv Acronym AS application local=t OUTPUTNEW "Authorization Removal Date" | rename norton_assets as norton | lookup servertypes_scanner_weights.csv servertype OUTPUTNEW norton_weight nexpose_weight nessus_weight metasploit_weight openvas_weight nexpose_weight | eval norton = if(like(norton, "%2019") AND relative_time(now(), "-30d@d") < strptime(norton,"%m/%d/%Y"), norton_weight, 0) | eval nessus = if(like(nessus, "%2019") AND relative_time(now(), "-30d@d") < strptime(nessus,"%m/%d/%Y"), nessus_weight, 0) | eval metasploit = if(like(metasploit, "%2019") AND relative_time(now(), "-30d@d") < strptime(metasploit,"%m/%d/%Y"), metasploit_weight,0) | eval nexpose = if(like(nexpose, "%2019") AND relative_time(now(), "-30d@d") < strptime(nexpose,"%m/%d/%Y"), nexpose_weight, 0) |eventstats count(ip) as total sum(norton) as norton_points sum(nessus) as nessus_points sum(meteasploit) as metasploit_points sum(nexpose) as nexpose_points count(eval(found="Yes")) as found_yes by system sum(norton_weight) as norton_points_possible sum(nessus_weight) as nessus_points_possible sum(metasploit_weight) as metasploit_points_possible sum(nexpose_weight) as nexpose_points_possible | eval norton_score = round (((norton_points / norton_points_possible)*100), 2) | eval nessus_score = round (((nessus_points / nessus_points_possible)*100), 2) | eval metasploit_score = round (((metasploit_points / metespliot_points_possible)*100), 2) | eval nexpose_score = round (((nexpose_points /nexpose_points_possible)*100), 2) | dedup system | eval date = strftime(now(), "%m/%d/%Y") | eval _time = strptime(date, "%m/%d/%Y") | fields _time date norton_score nessus_score metasploit_score nexpose_score So, I did some re-configuring by adding the "sum" of the count of systems that have a "_weight" or "0" and add the "sum" of the "_weights." Then divide the total of systems that have a weight by the "sum" of the "_weights." This appears to work =0) ... View more

Okay, figured it out: |inputlookup ip_dump.csv | streamstats count("IP Address") as row_number | where row_number <= 50000 | append [ |inputlookup ip_dump.csv | streamstats count("IP Address") as row_number | where row_number > 50000] ... View more

| inputlookup scanner_visibility.csv | lookup visibility_blue.csv Acronym AS application local=t OUTPUTNEW "Risk Score" | lookup server_dump.csv Acronym AS application local=t OUTPUTNEW "Authorization Removal Date" | rename norton_assets as norton | lookup servertypes_scanner_weights.csv servertype OUTPUTNEW norton_weight tanium_weight nessus_weight metasploit_weight openvas_weight nexpose_weight | eval norton = if(like(norton, "%2019") AND relative_time(now(), "-30d@d") < strptime(norton,"%m/%d/%Y"), norton_weight, 0) | eval tanium = if(like(tanium, "%2019") AND relative_time(now(), "-30d@d") < strptime(tanium,"%m/%d/%Y"), tanium_weight, 0) | eval nessus = if(like(nessus, "%2019") AND relative_time(now(), "-30d@d") < strptime(nessus,"%m/%d/%Y"), nessus_weight, 0) | eval metasploit = if(like(metasploit, "%2019") AND relative_time(now(), "-30d@d") < strptime(metasploit,"%m/%d/%Y"), metasploit_weight,0) | eval openas = if(like(openvas, "%2019") AND relative_time(now(), "-30d@d") < strptime(openvas,"%m/%d/%Y"), openvas_weight, 0) | eval nexpose = if(like(nexpose, "%2019") AND relative_time(now(), "-30d@d") < strptime(nexpose,"%m/%d/%Y"), nexpose_weight, 0) |eventstats count(ip) as total sum(norton) as norton_count sum(tanium) as tanium_count sum(nessus) as nessus_count sum(meteasploit) as metasploit_count sum(openvas) as openvas_count sum(nexpose) as nexpose_count count(eval(found="Yes")) as found_yes by system | eval norton_score = round (((norton_count / total)*100), 2) | eval tanium_score = round (((tanium_count / total)*100), 2) | eval nessus_score = round (((nessus_count / total)*100), 2) | eval metasploit_score = round (((metasploit_count / total)*100), 2) | eval openvas_score = round (((openvas_count / total)*100), 2) | eval nexpose_score = round (((nexpose_count / total)*100), 2) | dedup system | eval final_result = norton_score + tanium_score + nessus_score + metasploit_score + openvas_score + nexpose_score | rename final_result as visbility | fields system total visibility norton_count norton_score I got with a programmer at work and he suggested to use an "| lookup" to loop over the weights in the servertypes_scanner_weights.csv and OUTPUT them as new fields. With that we reworked the "count"s as "sum"s and brought back the "eval" statements without the scoring. It worked! | fields system total visibility norton_count norton_score HHS_System 3 100% 3 100% PPH_System 6 77% 3 100% I know the above is true because I verified it manually. Thanks for the the help! =0) ... View more