Sample given from Splunk:
... | eval wd=lower(Day) | eval sort_field=case(wd=="monday",1, wd=="tuesday",2, wd=="wednesday",3, wd=="thursday",4, wd=="friday",5, wd=="weekend",6) | sort sort_field | fields - sort_field
Mine:
index=myindex sourcetype=mysourcetype vendor=myvendor | eval sort_killchain=case(cat=="BOTNET ACTIVITY",1,cat=="COMMAND & CONTROL",2,cat=="RECONNAISSANCE",3,cat=="LATERAL MOVEMENT",4,cat=="EXFILTRATION",5) |stats count by cat |where cat=="COMMAND & CONTROL" OR cat=="RECONNAISSANCE" OR cat=="LATERAL MOVEMENT" OR cat=="BOTNET ACTIVITY" OR cat=="EXFILTRATION" | sort by sort_killchain
Any reason why mine shouldn't work?
Add your sort_killchain after the stats command. The filed sort_killchain is NOT referred in stats and hence the output of stats has only cat and count.
index=myindex sourcetype=mysourcetype vendor=myvendor |stats count by cat
| eval sort_killchain=case(cat=="BOTNET ACTIVITY",1,cat=="COMMAND & CONTROL",2,cat=="RECONNAISSANCE",3,cat=="LATERAL MOVEMENT",4,cat=="EXFILTRATION",5)
|where cat=="COMMAND & CONTROL" OR cat=="RECONNAISSANCE" OR cat=="LATERAL MOVEMENT" OR cat=="BOTNET ACTIVITY" OR cat=="EXFILTRATION" | sort by sort_killchain
Add your sort_killchain after the stats command. The filed sort_killchain is NOT referred in stats and hence the output of stats has only cat and count.
index=myindex sourcetype=mysourcetype vendor=myvendor |stats count by cat
| eval sort_killchain=case(cat=="BOTNET ACTIVITY",1,cat=="COMMAND & CONTROL",2,cat=="RECONNAISSANCE",3,cat=="LATERAL MOVEMENT",4,cat=="EXFILTRATION",5)
|where cat=="COMMAND & CONTROL" OR cat=="RECONNAISSANCE" OR cat=="LATERAL MOVEMENT" OR cat=="BOTNET ACTIVITY" OR cat=="EXFILTRATION" | sort by sort_killchain