Hi,
I am tracking my assets with vulnerabilities. My minimized sample query is:
index=vuln
| stats dc(dns) as impacted_asset_count by Vuln_ID, CVE
When stats populate, it shows that one vulnerability is affecting multiple assets and several Vuln_IDs have multiple CVEs.
Sample:
As you notice, there are multiple CVEs in some Vuln IDs. I need to have CVEs seperated/expanded/extracted as they are multivalue field and then have correct stats. Each CVE is impacting more than one assets so, I need it like this:
Thanks in-advance!!!
I ended up using:
| makemv delim="," cve
| mvexpand cve
index=vuln
| stats dc(dns) as impacted_asset_count values(Vuln_ID) as Vuln_ID by CVE
This is better.
by
extracts multi values
Hi @ to4kawa
This does not do it because cve is a multivalue field. AT minimum, it has one CVE and there are several vuln ids which have more than one CVE as shown in first screenshot. cves need to be extracted using regex or eval and then do stats will do it looks like. I will need regex or eval pls.
I see, my answer is updated