Splunk Search

Using Stats Average and Count to Display my Results

Makinde
New Member

Hi All,

I have a search string that reports three fields, Server name, Vulnerability and Severity (in numbers from 1 to 5).

So it is possible one server could have multiple vulnerability and each vulnerability has a severity in numbers

I would like to display my result by counting the number of times each server appears in my results which would mean that's the number of vulnerabilities found on that server, keep in mind each vulnerability found on that server has a severity, then I would like to do an average of all the severity for the vulnerabilities found on each server. so the result looks like

Server Name Count Average Severity
Server1 12 2.5
Server2 9 3.4
Server3 24 3.8

I have search strings that can generate Server_Name and Count and another one to generate Server Name and Average Severity but I need to know how to combine it so they can all be displayed in one table.

Here are the two different search strings;

index=main | stats count by Server_Name

index=main | stats avg(severity) by Server_Name

How can I get both search stirngs to become one and display both information correctly as described above?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Combine the two stats commands into one.

index=main | stats count(severity) as Count avg(severity) as Average by Server_Name
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Combine the two stats commands into one.

index=main | stats count(severity) as Count avg(severity) as Average by Server_Name
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...