topic Re: Need to re-create similar data chart within splunk with Windows Event ID's in Getting Data In

Need to re-create similar data chart within splunk with Windows Event ID's

jagasiab — Tue, 16 Dec 2014 14:13:04 GMT

Hello everyone,

I'm trying to re-create a similar bar chart as seen below, within splunk.

As you can see, it would list event ID's, with the count and percentile of events occurred. We have about 38 event ID's that would need be calculated.

Any assistance would be beneficial, as I do not yet quite understand the language splunk speaks.

Thanks

Re: Need to re-create similar data chart within splunk with Windows Event ID's

MuS — Tue, 16 Dec 2014 14:19:44 GMT

Hi jagasiab,

try something like this, assuming you have a field for your event ID's called EventCode:

index=* sourcetype="WinEventLog:Security" | stats count AS myCount by EventCode, host | eventstats sum(myCount) as total | eval percent = round(myCount/total, 2)  | fields - total

hope this helps to get you started ...

cheers, MuS

Re: Need to re-create similar data chart within splunk with Windows Event ID's

jagasiab — Tue, 16 Dec 2014 16:54:00 GMT

Hi,

Thanks MuS for the reply however I'm going to need a little more assistance, if I can get a search report with the template of what I'm asking, I can probably work my way from there.

Thanks,

Re: Need to re-create similar data chart within splunk with Windows Event ID's

MuS — Wed, 17 Dec 2014 07:44:20 GMT

Install this app https://apps.splunk.com/app/1603/ take a closer look at the Table with data bars example and use my provided search in it; this should get you started ...

Re: Need to re-create similar data chart within splunk with Windows Event ID's

jagasiab — Wed, 17 Dec 2014 14:41:07 GMT

MuS,

I downloaded and got the app running, cloned the Table with data bars but I apologize I'm still quite new to splunk. I tried modifying the search string in the source of my clone data table, but I'm still not able to pull any results into the charts...

Thanks

Re: Need to re-create similar data chart within splunk with Windows Event ID's

MuS — Wed, 17 Dec 2014 14:51:19 GMT

I found some Windows events on my indexer and was able to use this search:

index=* sourcetype="WinEventLog:Security" | top limit=0 EventCode

adapt the search to your needs like different index or maybe sourcetype

Re: Need to re-create similar data chart within splunk with Windows Event ID's

jagasiab — Wed, 17 Dec 2014 15:31:08 GMT

Fantastic! That's what I was looking for...It's producing what I want... now I need to figure out how to start narrowing it down per each event code that is required to be audited, and the host the data is incoming from. How would I go about narrowing my search to an couple of event codes to chart out?

Thanks again MuS!

Re: Need to re-create similar data chart within splunk with Windows Event ID's

MuS — Wed, 17 Dec 2014 16:04:41 GMT

see my updated answer and please mark this as answered if this answers your question 😉 cheers, MuS