Splunk Search

How do I count certain field values by row and covert the total found into two other tables to be used in time charts? =0(

UMDTERPS
Communicator

alt text

I've been plugging away at this for a few days and I'm stuck =0(

Above is a lookup csv (insert dummy data) I have from Nessus. I am trying to use Splunk to create totals of vulnerability severity levels in two separate tables, one by organization and another by system.

Below is what I want to do, any ideas how to do this?

alt text

Lastly, I’m trying to use the newly created tables and make two time graphs on vulnerability severity level totals by organization/date and another graph by system/date. Scans are run everyday, so inevitability the totals will change over time, which is what I'm trying to capture with the time-charts.

Any ideas? Thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You can convert data which is like table 1 to table 2 and table 3 like this

Table 2

your current search with field DeviceName Organization System Severity_Level Date
| eval temp=Organization."###".System."###".Date
| chart count over temp by Severity_Level | addtotals
| rex field=temp "(?<Organization>.+)###(?<System>.+)###(?<Date>.+)" | fields - temp
| table System Organization Date *

For timechart, add this to above search

| eval _time=strptime(Date,"%m/%d/%Y")
| timechart sum(Total) by System

Table 3

your current search with field DeviceName Organization System Severity_Level Date
| eval temp=Organization."###".Date
| chart count over temp by Severity_Level | addtotals
| rex field=temp "(?<Organization>.+)###(?<Date>.+)" | fields - temp
| table Organization Date *

For timechart, add this to above search

| eval _time=strptime(Date,"%m/%d/%Y")
| timechart sum(Total) by Organization

View solution in original post

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="Device_Name,Organization,System,Severity_Level,Date
firewall01,net,internal,high,2/11/2019
firewall01,net,internal,high,2/11/2019
firewall01,net,external,low,2/11/2019
switch03,net,internal,medium,2/11/2019
switch03,net,internal,high,2/11/2019
switch03,net,external,high,2/11/2019
server01,app,frontend,very low,2/11/2019
server02,dev,backend,very low,2/11/2019
mail04,mail,exchange,very high,2/11/2019
mail05,mail,exchange,very high,2/11/2019"
| multikv forceheader=1
| table Device_Name,Organization,System,Severity_Level,Date
| stats count(eval(Severity_Level="very low")) as "Very Low"
,count(eval(Severity_Level="low")) as "Low"
,count(eval(Severity_Level="medium")) as "Mediun"
,count(eval(Severity_Level="high")) as "High"
,count(eval(Severity_Level="very high")) as "Very High"
,count as "Total" by System Organization Date
| appendpipe [ | rename System as _System
| stats sum(*) as * by Organization Date]

Hi, @UMDTERPS
Why log with images? This is quite hindering the answer.

0 Karma

UMDTERPS
Communicator

Hey @to4kawa

When I copy paste into Splunk answers, it does not keep the formatting (if I try changing it, and hit submit -it changes again). I thought it would b easier to understand that way.

Cheers

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can convert data which is like table 1 to table 2 and table 3 like this

Table 2

your current search with field DeviceName Organization System Severity_Level Date
| eval temp=Organization."###".System."###".Date
| chart count over temp by Severity_Level | addtotals
| rex field=temp "(?<Organization>.+)###(?<System>.+)###(?<Date>.+)" | fields - temp
| table System Organization Date *

For timechart, add this to above search

| eval _time=strptime(Date,"%m/%d/%Y")
| timechart sum(Total) by System

Table 3

your current search with field DeviceName Organization System Severity_Level Date
| eval temp=Organization."###".Date
| chart count over temp by Severity_Level | addtotals
| rex field=temp "(?<Organization>.+)###(?<Date>.+)" | fields - temp
| table Organization Date *

For timechart, add this to above search

| eval _time=strptime(Date,"%m/%d/%Y")
| timechart sum(Total) by Organization
0 Karma

UMDTERPS
Communicator

Your Answer works! Thank you! =0)

A programmer at work said an easier way might be this ( I will mark your answer correct):

|inputlookup Nessus.csv 
|eval Date = strptime(Date, "%m/%d/%Y") 
| search Status="Ongoing"
| chart count by Date System
| eval Date = strftime(Date, "%m/%d/%Y")
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...