×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
crossap
Path Finder
Member since: ‎03-17-2015
‎06-05-2020
Community Statistics
Posts 43
Solutions 2
Karma Given 1
Karma Received 3
Member Since ‎03-17-2015
Activity Feed
Topics I've Started
View All

comparing csv

by in Splunk Search
‎07-03-2015 06:02 AM
‎07-03-2015 06:02 AM
Hi, I am looking for a way to compare a database against an indexed CSV What I am exactly looking to do is the following TABLE1 VPPatchID | DATABOUT PATCH | hash/10034567 blahblah CSV FILE IP | DNS | ANOTHER | SOLUTION| 10.50.1.122 COMP1 blahblah blahblahblah hash/10034567 more blahblahblah I am looking for the command along the lines of Compare VPPATCHID from TABLE1 with CSVFILE and IF solution CONTAINS EXACT STRING from VPPATCHID then HIDE the row The theory is that this would then show us a list of machines that are not covered the other option is if it is possible for splunk to look at the CSV and extract the hash/100***** (always starts with a hash100 followed by 6 digits) Hopefully you will understand what I am looking to achieve thanks paul ... View more

Splunk DB Connect 1: How to improve my dbquery sea...

by in Splunk Search
‎06-10-2015 03:20 AM
‎06-10-2015 03:20 AM
Hi, I am looking for some help on the best way to speed up my dashboard load time. Currently, the searches I have enabled on my desktop seem to take a long time to load and makes showing the system frustrating My Overview Dashboard has 20 traffic lights with each one loading data from dbquery | dbquery "DATABASE" "SELECT * FROM SANS20Score" | WHERE SANSID = "1.1" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS1.1 | join [ | dbquery "DATABASE" "SELECT * FROM SANS20Score" | WHERE SANSID = "1.2" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS1.2] | join [ | dbquery "DATABASE" "SELECT * FROM SANS20Score" | WHERE SANSID = "1.3" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS1.3] | join [ | dbquery "DATABASE" "SELECT * FROM SANS20Score" | WHERE SANSID = "1.6" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS1.6] | eval SANS1=('SANS1.1'+'SANS1.2'+'SANS1.3'+'SANS1.6')/4 | fields SANS1 | rangemap field=SANS1 elevated=51-84 low=85-100 severe=0-50 default=none Is the issue my searches? or can you recommend anything to improve the slow load time. thanks ... View more

Re: Splunk DB Connect 1: How to edit my search to ...

by in Splunk Search
‎06-02-2015 07:34 AM
1 Karma
‎06-02-2015 07:34 AM
1 Karma
Hi, Koshyk's answer got me close to my end result | dbquery "DATABASE" "SELECT * FROM softwareinventory" | fields Application | dedup Application | join type=left Application [ | dbquery "DATABASE" "SELECT * FROM authorisedsoftware" | fields Application | stats count by Application | where count = 1 ] | where NOT count>0 Anything that's on the white list receives a 1 count, I just then filtered out any that did not have a count >0 thanks again Rich/Koshyk ... View more

Re: Splunk DB Connect 1: How to edit my search to ...

by in Splunk Search
‎06-02-2015 05:36 AM
‎06-02-2015 05:36 AM
Hi Rich, sorry for slow reply I tried both ways and seem to get the same results its showing my authorisedlist each time as I can see applications that are allowed within our business. ... View more

Re: Splunk DB Connect 1: How to edit my search to ...

by in Splunk Search
‎06-01-2015 04:20 AM
‎06-01-2015 04:20 AM
Hi Rich, Sadly this one doesn't seem to work. It displays items showing on my whitelist ... View more

Splunk DB Connect 1: How to edit my search to comp...

by in Splunk Search
‎05-28-2015 06:55 AM
‎05-28-2015 06:55 AM
Hi, I am working on a search string to extract a specific column named Applications from 2 databases I would then like to compare these 2 databases and output anything that is different This is to allow us to gather a list of un-approved software within the environment here is what I have so far | dbquery "DATABASE" "SELECT * FROM softwareinventory" | fields Application | dedup Application | appendcols [ | dbquery "DATABASE" "SELECT * FROM authorisedsoftware" | fields Application | rename Application to whitelist ] This returns all of the data, but I am unsure of how to compare the 2 columns and output those differences. thanks! ... View more

Re: search not working in dashboard

by in Dashboards & Visualizations
‎05-21-2015 05:50 AM
‎05-21-2015 05:50 AM
Hi, I managed to get this working by adding | fields SANS3 just before the | range thanks! ... View more

Re: search not working in dashboard

by in Dashboards & Visualizations
‎05-21-2015 05:07 AM
‎05-21-2015 05:07 AM
Hi, Do you check this by clicking to edit the search string? if so its as expeted anything weird like it needs to be appendcols rather than join? ... View more

Re: search not working in dashboard

by in Dashboards & Visualizations
‎05-21-2015 04:28 AM
‎05-21-2015 04:28 AM
Hi, I tried this and the XML is saving now but its only actually doing the first calculation not the entire part <query><![CDATA[ | dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED<1)) as success count as total| eval SANS31 = success/total*100 |fields SANS31 | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.2" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.2] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.3" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.3] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.6" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.6] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.7" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.7] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.10" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.10] | eval SANS3=('SANS31'+'SANS3.2'+'SANS3.3'+'SANS3.10'+'SANS3.7'+'SANS3.6')/6 | rangemap field=SANS3 elevated=51-84 low=85-100 severe=0-50 default=none]]></query> ... View more

Re: search not working in dashboard

by in Dashboards & Visualizations
‎05-21-2015 04:10 AM
‎05-21-2015 04:10 AM
Is there another way I can post all of the xml? due to the crazy formatting that comes through ... View more

Re: search not working in dashboard

by in Dashboards & Visualizations
‎05-21-2015 04:09 AM
‎05-21-2015 04:09 AM
Hi, Hope this pastes ok as I cant attach a file (karma points) SANS 20 OVERVIEW <panel> <title>SANS 1</title> <single> <title>Authorized &amp; Unauthorized Devices</title> <search> | dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED<1)) as success count as total | eval value = success/total*100 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information SANS 2 Authorized & Unauthorized Software | stats count as value | eval value = 0 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information SANS 3 Secure Configurations for Hardware & Software | dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED<1)) as success count as total| eval SANS31 = success/total*100 |fields SANS31 | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.2" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.2] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.3" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.3] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.6" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.6] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.7" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.7] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.10" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.10] | eval SANS3=('SANS31'+'SANS3.2'+'SANS3.3'+'SANS3.10'+'SANS3.7'+'SANS3.6')/6 | rangemap field=SANS3 elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information SANS 4 Continuous Vulnerability Assesment | stats count as value | eval value = 95 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information SANS 5 Malware and Anti virus Defenses | stats count as value | eval value = 95 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information <panel> <title>SANS 6</title> <single> <title>Application Software</title> <search> | stats count as value | eval value = 20 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information SANS 7 Wireless Access Control | stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information SANS 8 Data Recovery Capability | stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information SANS 9 Secure Skills Assesment | stats count as value | eval value = 10 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information SANS 10 Secure Configurations | stats count as value | eval value = 10 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information <panel> <title>SANS 11</title> <single> <title>Limitation &amp; Control of Network Ports, Protocols</title> <search> | stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information SANS 12 Controlled use of Administrative Privileges | stats count as value | eval value = 60 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information SANS 13 Boundary Defense | stats count as value | eval value = 70 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information SANS 14 Monitoring of Logs | stats count as value | eval value = 20 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information SANS 15 Controlled Access based on Need to Know | stats count as value | eval value = 20 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information <panel> <title>SANS 16</title> <single> <title>Account Monitoring &amp; Control</title> <search> | stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information SANS 17 Data Protection | stats count as value | eval value = 30 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information SANS 18 Incident Response & Management | stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information SANS 19 Secure Network Engineering | stats count as value | eval value = 14 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information SANS 20 Penetration Tests | stats count as value | eval value = 95 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none -15m now range value ellipsisNone 0 visible visible visible linear linear false inherit radialGauge 50 10 area gaps 0.01 default shiny all 0 ellipsisMiddle right search [0,49,84,100] [0xd13b3b,0xebe42d,0x7e9f44] none Additional Information ... View more

search not working in dashboard

by in Dashboards & Visualizations
‎05-21-2015 03:52 AM
‎05-21-2015 03:52 AM
Hi, newly created search will not work as part of dashboard | dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED<1)) as success count as total| eval SANS31 = success/total*100 |fields SANS31 | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.2" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.2] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.3" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.3] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.6" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.6] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.7" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.7] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.10" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.10] | eval SANS3=('SANS31'+'SANS3.2'+'SANS3.3'+'SANS3.10'+'SANS3.7'+'SANS3.6')/6 The error I get when trying to save is Encountered the following error while trying to update: In handler 'views': Error parsing XML on line 9: StartTag: invalid element name Lots of the search is showing in RED when added to the dashboard code (but works is pasted into search without the rangemap text) <search> <query>| dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED<1)) as success count as total| eval SANS31 = success/total*100 |fields SANS31 | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.2" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.2] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.3" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.3] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.6" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.6] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.7" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.7] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.10" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.10] | eval SANS3=('SANS31'+'SANS3.2'+'SANS3.3'+'SANS3.10'+'SANS3.7'+'SANS3.6')/6 | rangemap field=SANS3 elevated=51-84 low=85-100 severe=0-50 default=none</query> -15m now ... View more

Re: Search failing to show last formula

by in Splunk Search
‎05-21-2015 02:52 AM
‎05-21-2015 02:52 AM
can you pop something in the answer box - seems I cant mark comments as answers I will then accept and award points thanks! ... View more

Re: Search failing to show last formula

by in Splunk Search
‎05-21-2015 02:43 AM
1 Karma
‎05-21-2015 02:43 AM
1 Karma
Hi Arun, There were 2 issues You resolved the first with the above (thanks!!) and the second was a incorrect name (not SANS3.1 should have been SANS31 in the forumla) | eval SANS3=('SANS31'+'SANS3.2'+'SANS3.3'+'SANS3.10'+'SANS3.7'+'SANS3.6')/6 thanks alot mate! ... View more

Re: Search failing to show last formula

by in Splunk Search
‎05-21-2015 02:27 AM
‎05-21-2015 02:27 AM
Hi Arun, There were no null values all showed 0 but I tried that anyway - but sadly not resolved the issues the table that displays SANS31 SANS3.10 SANS3.2 SANS3.3 SANS3.6 SANS3.7 2.266010 0 0 100 0 100 I then want another column SANS3 which is each of the searches I listed above added together then / 6 FYI it always complains about the /6 saying it must be a number? I have been removing this just to see if the new column appears but it doesnt ... View more

Search failing to show last formula

by in Splunk Search
‎05-21-2015 12:44 AM
‎05-21-2015 12:44 AM
Hi, I am trying to add each of the scores being pulled through and / to get the average here is my search (I am sure there's a better method) | dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED<1)) as success count as total| eval SANS31 = success/total*100 |fields SANS31 | appendcols [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.2" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.2] | appendcols [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.3" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.3] | appendcols [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.6" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.6] | appendcols [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.7" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.7] | appendcols [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.10" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.10] | eval SANS3=(SANS3.1+SANS3.2+SANS3.3+SANS3.6+SANS3.7+SANS3.10)/6 The plan is to the output the Average to my traffic light range to see how the overall compliance with that SANS control is going. It all works apart from | eval SANS3=(SANS3.1+SANS3.2+SANS3.3+SANS3.6+SANS3.7+SANS3.10)/6 The SANS3 column never displays? (even without the /6) Any help would be greatly appreciated ... View more

Re: calculate average value based on multiple sear...

by in Splunk Search
‎05-21-2015 12:38 AM
‎05-21-2015 12:38 AM
Hi Rich, you're the closest answer - I have slightly changed it and now have another issue which I shall log separate thanks for your help ... View more

Re: calculate average value based on multiple sear...

by in Splunk Search
‎05-18-2015 07:32 AM
‎05-18-2015 07:32 AM
Hi Rich, Ahh ok - hopefully someone who has experience of html will be able to assist if they see this post. thanks again ... View more

Re: calculate average value based on multiple sear...

by in Splunk Search
‎05-18-2015 05:14 AM
‎05-18-2015 05:14 AM
Hi Rich, thanks for your reply Its very nearly there -the only issue being the Eval = for sans 32 & 33. I would like this to be pulled through (dynamic) so that they only need amended in one location I am not sure if this is even possible here is my current complete code <single> <title>Standard secure configuration</title> <search> <query>| dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED&lt;1)) as success count as total | eval value = success/total*100 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="field">value</option> <option name="classField">range</option> <option name="linkView">search</option> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">false</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">radialGauge</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> <option name="drilldown">none</option> </single> <html> <a href="https://splunkserver/en-US/app/Sans_Pmc/sans_311">Additional Information</a> </html> </panel> <panel> <title>SANS 3.2</title> <single> <title>Automated patching</title> <search> | stats count as value | eval value = 64 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none <earliest>-15m</earliest> <latest>now</latest> </search> <option name="field">value</option> <option name="classField">range</option> <option name="linkView">search</option> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">false</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">radialGauge</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> <option name="drilldown">none</option> </single> <html> <a href="https://splunkserver/en-GB/app/Sans_Pmc/sans_32">Additional Information</a> </html> </panel> <panel> <title>SANS 3.3</title> <single> <title>Limit Administrative priviledges</title> <search> | stats count as value | eval value = 80 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none <earliest>-15m</earliest> <latest>now</latest> </search> <option name="field">value</option> <option name="classField">range</option> <option name="linkView">search</option> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">false</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">radialGauge</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> <option name="drilldown">none</option> </single> <html> <a href="https://splunkserver/en-GB/app/Sans_Pmc/sans_33">Additional Information</a> </html> </panel> Is it possible to pull through the | stats count as value | eval value = 80 in the above to the new search? this would allow the non dynamic results to only be updated in 1 location. Hope the above makes sense - sorry it's hard to show/explain without pictures ... View more

calculate average value based on multiple search a...

by in Splunk Search
‎05-18-2015 04:52 AM
‎05-18-2015 04:52 AM
Hi, I am still working on my SANS dashboard and am looking to create a value based upon multiple searches and static values I will explain the current setup as best I can The SANS 3 score will be derived from adding together the results from these searches and static value (all contained within a seperate dashboard) SANS 3.1 | dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED<1)) as success count as total | eval value = success/total*100 (lets say its 79 %) SANS 3.2 | stats count as value | eval value = 64 SANS 3.3 | stats count as value | eval value = 50 SANS 3 value should be 79+64+50/3=64.3 avg score My query is how can I link the searches together and also include the static values that are not searches but just a manual eval value=? thanks! ... View more

Re: search not returning expected results

by in Splunk Search
‎05-14-2015 07:04 AM
‎05-14-2015 07:04 AM
Thanks again Rich It's just I am trying work out where I am going wrong, to avoid posting to many community questions 🙂 ... View more

Re: search not returning expected results

by in Splunk Search
‎05-14-2015 06:49 AM
‎05-14-2015 06:49 AM
Hi Rich, that worked perfectly - thank you so much! Sorry to be annoying but why does it require "" a very similar search stats count(eval(FAILED<1)) as success count as total | eval Compliant %=success/total*100 Works perfectly without? thanks ... View more

search not returning expected results

by in Splunk Search
‎05-14-2015 06:38 AM
‎05-14-2015 06:38 AM
Hi, I am using DBConnect to connect to a DB export from Qualys This export shows the results of a scan to determine if autoplay is disabled I want to create a % machines that are compliant - the table has ID | HOST_ID | CONTROL_ID | STATUS when using the below search it shows me 0 results in passed and the total machine number is 575 (passed & failed) | dbquery "DB_NAME" "SELECT * FROM SANS0503" | stats count(eval(STATUS=Passed)) as Passed count as total If I perform | dbquery "DB_NAME" "SELECT * FROM SANS0503" | search STATUS=Passed I get the result of 551 (which is great) but I do not understand why I am getting 0? thanks ... View more

Re: turning calculated percentage into traffic lig...

by in All Apps and Add-ons
‎04-30-2015 03:39 AM
‎04-30-2015 03:39 AM
Hi All, I managed to resolve my own question the answer is | dbquery "DBNAME" "SELECT * FROM TABLE"| stats count(eval(FAILED<1)) as success count as total | eval value = success/total*100 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none This is now displaying a RED traffic light as we are only 2% compliant Hope this helps someone else in the future ... View more

Re: turning calculated percentage into traffic lig...

by in All Apps and Add-ons
‎04-29-2015 03:30 AM
‎04-29-2015 03:30 AM
Hi, Just checking if what I am asking for is technically possible with splunk? or will it be easier if I index the DB? can I then turn that into the percentage and make the range (traffic lights) change colour? thanks ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma from
View All
Karma given to
View All