I have tried the below query,it works fine,but its complicated, Can anyone suggest a better way to write the same query,
index="vmt_sample" "Asset Type"=Desktop OR "Thin Client" OR Computer|fillnull value=blank "MS Bulletin" "Flags"|search OS="Windows" |stats sum(CVSS) as CVSS by "Asset Type"|join [search index="vmt_sample" "Asset Type"=Desktop OR "Thin Client" OR Computer |fillnull value=blank "MS Bulletin" "Flags"| search OS="Windows" "MS Bulletin"!=blank "Flags"=blank |stats sum(CVSS_E) as "OS Score" by "Asset Type"]|table "Asset Type",CVSS,"OS Score"
Try this
index="vmt_sample" "Asset Type"=Desktop OR "Thin Client" OR Computer OS=Windows
| stats sum(CVSS) as CVSS sum(eval(if(isnotnull("MS Bulletin") AND isnull("Flags"), CVSS_E, 0))) as "OS Score" by "Asset Type"
| table "Asset Type",CVSS,"OS Score"
Try this
index="vmt_sample" "Asset Type"=Desktop OR "Thin Client" OR Computer OS=Windows
| stats sum(CVSS) as CVSS sum(eval(if(isnotnull("MS Bulletin") AND isnull("Flags"), CVSS_E, 0))) as "OS Score" by "Asset Type"
| table "Asset Type",CVSS,"OS Score"