I have created several 'rex' expressions that parse data into their own fields and the created multivalue fields combining these into a common field. I'd like to know if it is possible to query this mutlivalue field and get the sum of a different field.  vuln_summary threat_value date Microsoft finding a 2900 5/28/2021 Microsoft finding a 100 5/28/2021 Skype finding a 500 5/28/2021 Windows finding a 3000 5/28/2021 Windows finding b 2500 5/28/2021 Linux finding a 1000 5/28/2021 Linux finding b 500 5/28/2021 I've created the following rex fields that work to lumb these findings together:   | rex field=vuln_summary "(?<ms>^.*?(Microsoft).*?$)" | rex field=vuln_summary "(?<skype>^.*?(Skype).*?$)" | rex field=vuln_summary "(?<windows>^.*?(Windows).*?$)" | rex field=vuln_summary "(?<linux_os>^.*?(Linux)|(linux).*?$)"    Then a multivalue field that combines them into one field called 'microsoft' and similar for Linux:   | eval microsoft=mvappend(ms, windows, skype, rpc) | eval linux=mvappend(linux_os, grub, bind, gnome, libpng, curl)   I'd like to get the sum of the 'threat_value' for the multivalue fields and other fields for a stacked bar chart by Date.  Something like below, I think:  Date sum of TRS for microsoft sum of TRS for linux sum of TRS for field 'x' 05/28/2021 9000 1500 nnn                 ... View more

I have built a query that exports data by a date range and based on a scan or source. Currently I'm grouping them into a multivalued field so that I can have 1 row per source and can easily see all the impacted data by date range (see below): Source Within 30 Days 30-60 Days 60-90 Days 90+ Days scan1.csv Low SSL/TLS Diffie-Hellman Modulus <= 1024 Bits (Logjam) 192.168.0.1 Medium SSL Certificate Cannot Be Trusted 192.168.0.1   Medium SMB Signing not required 192.168.0.15   Low SSL/TLS Diffie-Hellman Modulus <= 1024 Bits (Logjam) 192.168.0.15 Medium SSL Self-Signed Certificate 192.168.0.1   Medium SMB Signing not required 192.168.0.1     Medium SSL Certificate Cannot Be Trusted 192.168.0.15     As you can see above with the Logjam finding, I'm repeating the 'Severity' and 'Plugin Name' respectively with a unique IP address. I'd like, however, to only see the new IP address in this instance (see below) but have been unable to find a way to group by 'severity' and 'plugin_name' within the multivalued group.  desired output Using the test data below, you can use this search string to reproduce the 1st table above:   | inputlookup test.csv | eval epochTime=now()-firstSeen | eval dateRange=case(epochTime <= (86400*30), "Within 30 Days" , epochTime >= (86400*31) AND epochTime <= (86400*60), "30-60 Days", epochTime >= (86400*61) AND epochTime <= (86400*90), "60-90 Days", epochTime > (86400*91), "90+ Days") | dedup severity plugin_name ipv4 | sort severity plugin_name ipv4 | eval findings30days=case(dateRange=="Within 30 Days", mvappend(severity, plugin_name, ipv4)) | eval findings3060days=case(dateRange=="30-60 Days", mvappend(severity, plugin_name, ipv4)) | eval findings6090days=case(dateRange=="60-90 Days", mvappend(severity, plugin_name, ipv4)) | eval findingsOver90days=case(dateRange== "90+ Days", mvappend(severity, plugin_name, ipv4)) | rename source AS Scan, severity AS Severity, plugin_name AS "Plugin Name", dateRange AS Age, ipv4 AS IP | stats list(findings30days) AS "Within 30 Days" list(findings3060days) AS "30-60 Days" list(findings6090days) AS "60-90 Days" list(findingsOver90days) AS "90+ Days" by Scan   Below is some sample data that may be useful: source                     severity   ipv4                         plugin_name                                                                           firstSeen scan1.csv                 Medium  192.168.0.1             SSL Certificate Cannot Be Trusted                                          1617212174 scan1.csv                 Medium  192.168.0.15           SSL Certificate Cannot Be Trusted                                          1617212174 scan1.csv                 Medium  192.168.0.1             SSL Self-Signed Certificate                                                     1619459159 scan1.csv                 Medium  192.168.0.1             SSL Certificate with Wrong Hostname                                   1619459159 scan1.csv                 Medium  192.168.0.15           SSL Self-Signed Certificate                                                     1617212174 scan1.csv                 Medium  192.168.0.15           SSL Certificate with Wrong Hostname                                   1617212174 scan1.csv                 Medium  192.168.0.1             TLS Version 1.0 Protocol Detection                                        1619459159 scan1.csv                 Medium  192.168.0.15           TLS Version 1.0 Protocol Detection                                        1619459159 scan2.csv                 Medium  192.168.0.2             TLS Version 1.0 Protocol Detection                                        1619459159 scan2.csv                 Medium  192.168.0.2             SSL Certificate with Wrong Hostname                                   1619459159 scan2.csv                 Medium  192.168.0.2             SSL Certificate Cannot Be Trusted                                          1619459159 scan2.csv                 Medium  192.168.0.3             TLS Version 1.0 Protocol Detection                                        1619459159 scan2.csv                 Medium  192.168.0.3             SSL Certificate with Wrong Hostname                                   1620053764 scan2.csv                 Medium  192.168.0.3             SSL Certificate Cannot Be Trusted                                          1620053764 scan1.csv                 Medium  192.168.0.1             SSL RC4 Cipher Suites Supported (Bar Mitzvah)                    1620053764 scan1.csv                 Medium  192.168.0.1             SSL Medium Strength Cipher Suites Supported (SWEET32) 1620053764 scan1.csv                 Low         192.168.0.15           SSL/TLS Diffie-Hellman Modulus <= 1024 Bits (Logjam)       1620053764 scan1.csv                 Low         192.168.0.1             SSL/TLS Diffie-Hellman Modulus <= 1024 Bits (Logjam)       1620053764 Current output in Splunk is below: current output ... View more

I have the query below and I'm trying to get the count of hosts affected by the vulnGrouping split by priority. Whereas currently the query return the total count for both combined.  The SPL is grouping like software by a high level name (i.e., Adobe, Cisco Software, Oracle Software, etc.), then I have applied logic to determine the Risk level. Lastly getting a count of the IPv4 addresses affected.  | eval vulnGrouping=case(plugin_name like "Adobe%", "Adobe", plugin_name like "Google%", "Google Chrome", plugin_name like "Oracle%", "Oracle Software", plugin_name like "Cisco%", "Cisco Software") | stats values(priority) dc(ipv4) by vulnGrouping The output is similar to below: vulnGrouping values(priority) dc(ipv4) Adobe Critical High 100 Google Chrome Critical High 500   Where I'd like to be is something like this: vulnGrouping values(priority) dc(ipv4) Adobe Critical High 75 25 Google Chrome Critical High 150 350   Any ideas or help is greatly appreciated.  ... View more

I have created the search below which:  Filters out by only hostnames that I want Then extracts the STIG ID from those results Then extracts the controls status Lastly, consolidating Errors, Failed, and Warnings into a group of 'failed' controls with the remaining being "Passed" What I would like to do is identify any controls that have passed across all of the hostnames and vice versa identify the controls that have failed across all of the host names. Example: 15 STIG ID(s) have Failed across all hosts. 200 STIG ID(s) have passed a crossed all hosts. Failed Passed 15 200   index="tenable" sourcetype="tenable:sc:vuln" repository="Audit Repository" [ inputlookup windows10_hostnames.csv | fields dnsName ] | rex field=pluginName "(?<stigid>\w{4}\S\w{2}\S\d{6})\s+.*" | rex field=pluginText "\<cm\:compliance-result\>(?<status>\w+)\<\/cm\:compliance-result\>" | eval passFail=if(IN(status,"ERROR","FAILED","WARNING"), "Failed","Passed")   I tried appending the below to the end of this query. While it's interesting data, I'm having a hard time figuring out the comparison and filtering to get the desired output in the table above.   | stats values(stigid) by dnsName passFail | stats count by dnsName passFail   Any help is much appreciated.   ... View more