My last stats command is not showing the values by sublocation. It shows each sublocation but no values are shown.
index=###### sourcetype=#######
| lookup csirt_asset_list ip OUTPUT sublocation
| search hasBeenMitigated=0 sublocation=*
| stats dc(ip) as Total1 by sublocation
| join [ search index=##### sourcetype=##### pluginID<1000000 baseScore>0
| lookup csirt_asset_list ip OUTPUT sublocation
| search hasBeenMitigated=0 sublocation=*
| stats dc(ip) as Total2 by sublocation]
| join [search index=##### sourcetype=##### pluginID<1000000 baseScore>0
| lookup csirt_asset_list ip OUTPUT sublocation
| search hasBeenMitigated=0 sublocation=*
| stats count as counted by baseScore, sublocation
| fields + sublocation, baseScore, counted
| sort-baseScore
| lookup weight_lookup baseScore OUTPUT wmultiplier
| eval aaa=(counted * wmultiplier)
| eventstats sum(aaa) as test1, sum(counted) as test2
| eval bbb=(test1 / test2)
| eval bbb=round(bbb,2)]
| eval cvss_overall_score=bbb*(Total2/Total1)
| stats latest(cvss_overall_score) as "CVSS Overall Score" by sublocation
OUTPUT LOOKS LIKE THIS
sublocation CVSS Overall Score
abc
def
ghi
Nothing is showing under CVSS Overall Score. If I use:
| stats latest(cvss_overall_score) as "CVSS Overall Score"
It shows the CVSS Overall Score.
Thanks for your help
latest()
needs _time
field, which is missing in your resultset. Try last()
instead
latest()
needs _time
field, which is missing in your resultset. Try last()
instead
I tried evaling a _time field before running stats latest and it still didn't work. Is there some way I can force stats to recognize my new _time field?
Thanks for your help. That worked!