- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Meaning of OSSEC dashboard pie graph count values
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Meaning of OSSEC dashboard pie graph count values
In the OSSEC dashboard, what do the count values mean for the elements of the various "Top N" pie graphs? For example, at the moment in my "Top Signatures" pie graph, the count value for "Windows Error Event" is 42 but if I click on that element, the search results that come up exceed 250 records. I'm running version 1.1.81 of OSSEC for Splunk 4, on Splunk 4.2.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is a known bug in builds prior to 1.1.83.
It's showing the top 10 but the results are being clustered/grouped -- e.g., you get the top 10 users, but counting the user only once for a given reporting_host/severity/user. When you drill down, it swaps out the search and you see the full result set.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, I just untarred 1.1.84 directly on top of my /opt/splunk/etc/apps/ossec directory (which was 1.1.82) and indeed my dashboard counts look reasonable now. Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you haven't already, can you give the latest build on SplunkBase a try and see if it's still an issue for you?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Looks like the fix didn't make into the SplunkBase upload. The fix is probably sitting in local -- once I get back to my dev box I'll re-upload and bump the version number.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the clarification. So if it was a known bug previous to 1.1.82 then should I expect to see total (no clustered/grouped) alert counts in the "Top N" pie graphs and their respective tables? I'm asking because I just upgraded to 1.1.82 and it seems to look the same as before.
Index This | Forward, I’m heavy; backward, I’m not. What am I?
A Guide To Cloud Migration Success
Join Us for Splunk University and Get Your Bootcamp Game On!
