All, I've been banging my head against the wall on this. Maybe its not possible, I don't know. I'm doing a multi search and adding weight to the results depending on the severity. My main goal is to do all the "work" and timechart the end score. Here is my code, I'm sure I'm looking at this wrong. Any direction is appreciated.
index=security_vulnerabilities hasBeenMitigated=false ip="10.7*" severity!=informational
| dedup _raw
| eval crisk=case(severity=="critical",".35")
| search crisk=*
| timechart sum(crisk) as riskc
| eval diffc=297-riskc
| appendcols [search index=security_vulnerabilities hasBeenMitigated=false ip="10.7*" severity!=informational
| dedup _raw
| eval hrisk=case(severity=="high",".30")
| search hrisk=*
| timechart sum(hrisk) as riskh
| eval diffh=255-riskh ]
| appendcols [search index=security_vulnerabilities hasBeenMitigated=false ip="10.7*" severity!=informational
| dedup _raw
| eval mrisk=case(severity=="medium",".15")
| search mrisk=*
| timechart sum(mrisk) as riskhm
| eval diffm=127-riskm ]
| appendcols [search index=security_vulnerabilities hasBeenMitigated=false ip="10.7*" severity!=informational
| dedup _raw
| eval lrisk=case(severity=="low",".10")
| search lrisk=*
| timechart sum(lrisk) as riskhl
| eval diffl=85-riskl ]
| timechart score=(diffc+diffh+diffm+diffl)
What I have found, is that I can only sum the days risk(x) with the timechart command. I really don't need to use this command | timechart sum(lrisk) as riskhl, however this is the only way I can get the results I need. Below is the results displayed. As you see I am missing output I want, like diffm diffl and score.
_time riskc diffc diffh riskh riskhl riskhm
2019-12-17 62.30 234.70 74.40 180.60 34.50 76.50
2019-12-18 59.15 237.85 82.80 172.20 34.50 76.05
2019-12-19 61.60 235.40 79.20 175.80 34.30 85.80
2019-12-20 62.65 234.35 78.30 176.70 34.30 85.95
2019-12-21 8.40 288.60 238.80 16.20 1.50 5.10
2019-12-22 61.95 235.05 78.90 176.10 34.60 91.20
2019-12-23 135.45 161.55 -115.50 370.50 71.60 194.55
Thanks for looking.
... View more