Dashboards & Visualizations

How do I visualize changes to data from a sourcetype over time?

jambajuice
Communicator

I'm trying to make a dashboard to visualize nessus vulnerability data over time. For example, let's assume I run a vulnerability scan and get the following results (each line is a separate event):

results|192.168.1|192.168.1.100|epmap (135/tcp) results|192.168.1|192.168.1.100|netbios-ssn (139/tcp) results|192.168.1|192.168.1.100|rtsp (554/tcp) results|192.168.1|192.168.1.100|nessus (1241/tcp) results|192.168.1|192.168.1.100|http (8834/tcp)

Let's assume I disable nessus and the web server and the next time I scan I get the following results:

results|192.168.1|192.168.1.100|epmap (135/tcp) results|192.168.1|192.168.1.100|netbios-ssn (139/tcp) results|192.168.1|192.168.1.100|rtsp (554/tcp

If I want to create a chart that shows the number of results over time, how do I do that? How do I make the chart dynamically account for the fact that I may run the scan at variable time intervals (daily, weekly, monthly)?

Thanks.

Craig

Tags (1)
0 Karma

Ayn
Legend

Assuming you are producing nessus report files that are small enough that it takes Splunk less than a minute to index, and you're generating nessus reports less frequently than that interval, you should be able to use timechart for this purpose.

yoursearch | timechart span=1m count

You can feed this data into something like a line chart and configure it to connect non-null values.

0 Karma

Ayn
Legend

That's a bit trickier but can be done. Assuming you want to check the timestamp of the last event and then see all the other events in the preceding minute this search would work:

  • [yoursearch | head 1 | eval searchinterval=_time-60 | eval search="_time>" . searchinterval | fields search]
0 Karma

jambajuice
Communicator

Thanks!

What search do I need to use if I want to show all of the events with the most recent timestamp?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...