I am wanting to add a panel to a dashboard which shows a percentage of total vulnerable hosts to total hosts in the environment.
I already have 2 panels with a query in each the first showing the vulnerable hosts for a specific CVE($field1$) the second showing the total count in environment. They look like:
index = vulnerabilities $field1$| dedup host-fqdn| stats count(host-fqdn) AS Vulns
index = vulnerabilities | dedup host-fqdn| stats count(host-fqdn) AS total_hosts
My problem is i don't know how to call or use the Vulns or total_hosts count data in a thrid panel. I'm trying to use this:
index = vulnerabilities $field1$ |stats count(eval(eventtype="host-fqdn")) AS total, count(eval(eventtype="Vulns")) AS Vulns | eval percentage=((total/Vulns)*100) | table percent_difference.
Thank you for your help!
diggin
... View more