earliest=-100d index=nessus OR index=nessus_workstation severity_id!=0 severity_id!=1 | dedup signature_id sortby _time | join signature_id [ inputlookup nessusLookup.csv | fields signature_id assigned_person status notes] | search assigned_person="ryan*" | reltime | join type=outer signature_id [ search earliest=-4d index=nessus OR index=nessus_workstation severity_id!=0 severity_id!=1 | stats count(dest_mac) as TotalHosts by signature_id ] | sort -reltime -severity_id -TotalHosts | table signature signature_id severity_id assigned_person status notes reltime TotalHosts | rename signature as Signature signature_id as ID severity_id as Severity assigned_person as Owner status as Status notes as Notes reltime as "First Seen" TotalHosts as "Total Hosts" The problem: So I am wanting to sort vulnerabilities by the oldest one first. When I go through reltime Splunk sorts the string realtime returns. So instead of 28 days being smaller than 1 month it is marked as bigger. I have been fighting with this for a little bit now and I just think I am only seeing trees instead of the forest. Anyone want to poke me and send me off down the right path? The query: The first two lines are to get the base data where I want it to be the first join adds my lookup table to the mix (I do not want them to be automatic lookups) Then we filter for Ryan Then we add reltime the second join is so we only see the hosts most recently affected instead of getting all hosts that have ever been affected then we sort then we make a table and we tidy up by renaming ... View more

index=ios host=1.1.0.2 src_ip="1.2.2.1" "NBRCHANGE" | head 1 | eval status = if(like(_raw, "%down%"), 1 , 0) | stats count | eval status=if(count==0, "up", status) | table status This seems to be a simple query but for some reason it really does not like me. I am wanting to return a default value of "up" if there is no results found. Long Explanation: I am creating a dashboard that will tell us if an interface on a router is down. Since our Index is large and is no position to be adjusted I am only checking for changes in the log over the last 30 days. At the end of the 30 days the dashboard will produce "No results found" because there has been no events in the last 30 days that matches the search. Because of this I want to setup a default value that will return. I have tried: fillnull | eval noResults = if(searchmatch("NBRCHANGE"),1,0) | stats count as myCount sum(noResults) AS noResults | eval noResults=if(myCount=="0",0,noResults) | eval status = case(noResults=="0", "first result returned", noResults!="0", if(like(_raw, "%down%"), "second result returned", "third result returned")) | table status ... View more