hello there, download the eventgen app: https://splunkbase.splunk.com/app/1924/ download the TA's that are related to the Cisco Security Suite for example TA for Cisco ASA look and locate the sample directory in each TA, you will find sample data events there. look for the eventgen.conf file under the /default directory of the TA's enable it and verify you have sample data install the Security Suite hope it helps ... View more

if you run your search until the first rename (before first stats), do you have all the wanted fields? What is the meaning of appendcols? remeber that (from https://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/Appendcols ) "The first subsearch result is merged with the first main result, the second subsearch result is merged with the second main result, and so on." What information do you want to add to the first stats results? Bye. Giuseppe ... View more

I think I see what the problem is; you have two searches that need to take place to match on ID from Plugin and plugin_ID from the scans. Give this search a try, it may take a bit longer. I'm going to use some of @cmerriman 's written code hope you don't mind. index=nessus cve=* | eval ID=coalesce(id,plugin_id) | eval CVSS_SCORE = cvss_base_score + cvss_temporal_score | rename cve as CVE | stats sum(CVSS_SCORE) as CVSS_SCORE values(plugin_name) as Plugin_Name by ID | appendcols [search index=nessus | rename host-ip as hostip | stats list(hostip) as hostips, list(IP) as IP, count(hostip) as HOSTS by plugin_id] | table ID, Plugin_Name, CVSS_SCORE, HOSTS | sort - CVSS_SCORE ... View more

Not the answer to the question he asked, but a great answer nonetheless. ... View more

Thank you! ... View more

I've used Firefox and Chrome. Both browsers automatically wrap text to fit within a table column. Horizontal scrolling is only needed when there are too many columns to fit in the window. ... View more

| stats count as CVECount or | stats dc(CVE) as CVECount You don't really need much of that if all you want is the count of CVEs... index=nessus cve=* | fields cve | dedup cve | stats dc(cve) as CVECount And if cve is an indexed field, then tstats would probably be more efficient tstats where index=nessus AND cve=* | stats dc(cve) as CVECount ... View more

these options did not work for me ... View more

You would need to update your dashboard xml to include following in your chart element. <option name="charting.fieldColors"> {"Systemic_Score(Unpatchable)": 0xFF0000, "Systemic_Score(Patchable)":0x0066FF} </option> For more details, go to below link and search for charting.fieldColors http://docs.splunk.com/Documentation/Splunk/6.6.1/Viz/ChartConfigurationReference ... View more

Does my answer above solve your question ? If yes, spare a moment to accept the answer and vote for it. Thanks. ... View more