Splunk Enterprise Security

Splunk Enterprise Security: How to write a search to create a time chart or a table with notable event times by hour?

kmcaloon
Explorer

Does anyone have a search to create either a timechart or a table with the notable event times by hour? I want to create a list of the busiest times our notables come in by urgency. I.E. 5 10 lows at 9:00, 11 lows at 10:00, 5 mediums at 9:00, 7 mediums at 10:00, etc.

This search works, but only for the last 24 hours:

| `es_notable_events` | search timeDiff_type=current | timechart minspan=1h sum(count) as count by urgency

I'd like to do an average number of tickets per hour of the day going back at least 30 days.

0 Karma

AnthonyTibaldi
Path Finder

'es_notable_events' works off an inputlookup that I don't think you can get data further back than the last 24 hours.

Try This search it seems to work for me.

`notable' | search NOT `suppression' | search (status="*") (owner="*") (security_domain="*") | timechart minspan=1h count by urgency

The 'notable' macro works of the notable index so you should get the data your looking for.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...