Splunk Search

How to use Stats and Eval to count how many times "Microsoft" is included in the OS?

mgubser
Explorer

I am reading nessus discovery scan logs and the way nessus formats their data is by separating fields by events. They run one test on an IP and get one result so for one IP they could have 30 events one having the Host Name, OS, Device type, etc.. When I use

Stats values(Computer_Name) values(Device_Type) values(Domain_Name) values(Device_FQDN) values(Device_HostName) values(MAC_Address) values(OS_Detected) values(Computer_Name) by Host 

I get all the fields I wanna see by Host(IP). I am unaware on how to search a specific stat to include a phrase as apposed to match it. If I do

|stats count(eval(OS_Detected=="Microsoft*")) AS Microsoft

I get a new field Microsoft that is all 0's

|stats count(eval(OS_Detected=="Microsoft Windows 7 Enterprise")) AS Microsoft

I get a 1 in that field for the ones that match

Thanks, Matt

Tags (3)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Use it like this (your current stats 'count(eval(OS_Detected=="Microsoft*"))' doesn't treat "*" as wildcard but a regular character, hence 0 count)

|stats count(eval(like(OS_Detected,"Microsoft%")) AS Microsoft

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Use it like this (your current stats 'count(eval(OS_Detected=="Microsoft*"))' doesn't treat "*" as wildcard but a regular character, hence 0 count)

|stats count(eval(like(OS_Detected,"Microsoft%")) AS Microsoft

mgubser
Explorer

How could I search these stat fields? I am trying to search these fields in a drill down. The user can pick all or the name of the OS. I can't figure out how to. I am trying to do it something like this.

| search values(OS_Detected)=="$OS_Detected$"

If i just search OS_Detected=$OS_Detected$ I will not return the other events with other info. I am trying really hard to not use a join.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...