Dashboards & Visualizations

I've got some information I'd like to turn into panels - am I going about this correctly?

davey1020
New Member

Hi All,

I've been using the Splunk Add-on for Tenable to import the network scans from Nessus Professional. This part works great, searches are fine. I wanted to go to the next step and create a dashboard with all my critical vulnerabilities and how many IPs are affected.

I've managed to kludge together a query to get a nice looking table - but can't seem to take the next step into:

  1. Taking each signature and creating a panel out of it
  2. Get the number of IPs that are affected by said signature as a sigle value in the panel for the signature

Right now my query is

sourcetype="nessus" OR sourcetype="nessus:scan" (severity="critical") | stats values(signature) as signature by dest, severity

It comes out with a table

dest severity signature
10.128.20.10 critical Apache 2.0.x < 2.0.48 Multiple Vulnerabilities (OF, Info Disc.)
PHP Unsupported Version Detection

Is this the best way to get to my requirement? Not sure how to integrate this into a panel.

Thanks for your help
--Dave

0 Karma

gjanders
SplunkTrust
SplunkTrust

The Save As dashboard panel on the RHS of the screen is how you can convert your search results into a dashboard panel

Perhaps you want to have a distinct count of the IP's by signature, dest, severity?

sourcetype="nessus" OR sourcetype="nessus:scan" (severity="critical") | stats dc(IP) by dest, severity, signature 

The above would assume your IP field is called "IP" and that you want it split by all three of those items...

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...