About vectra_tme

vectra_tme · ‎05-10-2017

You are correct, the range was not being generated. A simple fix of adding quotes, resolved the issue. Here is code that fixed my issue: <query>index=* sourcetype=Vectra-CEF signature="hsc" * | dedup src | search threat>0 AND certainty>0 | eval status= case(threat>=50 AND certainty>=50, "Critical", threat>=50 AND certainty<50, "High", threat<50 AND certainty>=50, "Medium", true(), "Low") | table status, certainty, threat</query> <option name="charting.fieldColors">{"Critical":0xbe1e2d,"High":0xf05a28,"Medium":0xfaaf40,"Low":0x4e6875}</option> Thanks for all of your help. Greatly appreciated.

vectra_tme · ‎05-09-2017

Based on what you provided, I have come up with the following but am still getting blue dots throughout the scatter plot <panel> <chart> <search> <query>index=* sourcetype=Vectra-CEF signature="hsc" $search$ | dedup src | search $hostseverity$ | table certainty,threat | eval range= case(threat >=50 AND certainty >=50, Red, threat >=50 AND certainty <50, Orange, threat <50 AND certainty >=50, Yellow, true(), Black)</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">scatter</option> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.maximumNumber">100</option> <option name="charting.axisX.minimumNumber">0</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.maximumNumber">100</option> <option name="charting.axisY.minimumNumber">0</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">none</option> <option name="charting.fieldColors">{"Red":0xff0000,"Orange":0xFF4500,"Yellow":0xffff00,"Black":0x000000}</option> </chart> </panel>

vectra_tme · ‎05-08-2017

I have a scatter plot that I am trying to assign colors to based on where the fall. As a example, I am plotting some points based on threat and certainty scores. I would like to be able to assign colors based on the following: threat >50 certanty >50 = Red threat >50 certainty<50 = Orange threat<50 certainty>50 = Yellow I have found some information on changing colors for line graphs, but have not found anything on scatter plots. I have tried using some of this logic without any luck. Any help is greatly appreciated.

vectra_tme · ‎12-16-2016

I have done some searching and have not been successful in getting this to work. Most of the examples assume you will be providing the base url and appending the value. In this case, I have a column that contains an absolute URL (https://...) and have added the following to my simple XML, but when I click on it, it prepends the Splunk URL <condition field="Host Details"> <link target="_blank"> <![CDATA[$click.value2$]]> </link> </condition> I have also tried using [https://$click.value2$] but then it prepends https:// so I get https://https://... I am sure it is something small that I am missing. Any help is greatly appreciated.

Posts	4
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎12-16-2016

Online Status	Offline
Date Last Visited	‎05-12-2022 05:43 PM

Scatter plot color assignment

How to edit my Simple XML to contain an absolute u...

Re: Scatter plot color assignment

Re: Scatter plot color assignment

Scatter plot color assignment

How to edit my Simple XML to contain an absolute u...