https://community.splunk.com/t5/Splunk-Enterprise-Security/How-can-I-do-a-graph-with-multiple-data/m-p/397297#M4424 <P>Hi team!</P> <P>It's my very first time here and I need a bit of help!</P> <P>I want to make a graph with multiple lanes.</P> <P>I have this right now. 1 graph per data. I want to fusion them but I don't know how.</P> <P>Graph 1.</P> <PRE><CODE>index=xxx_paloalto sourcetype="pan:threat" type=threat threat_name="SCAN: TCP Port Scan(8001)" (src_zone!="Inet-WAN1" AND src_zone!="Inet-WAN2") (dest_zone!="Inet-WAN1" AND dest_zone!="Inet-WAN2") src_ip != xxx | stats by src_ip, dest_ip, _time | bin _time span=1d | stats count by _time </CODE></PRE> <P>Graph 2</P> <PRE><CODE>index=xxx_paloalto sourcetype="pan:threat" type=threat threat_name="SCAN: Host Sweep(8002)" (src_zone!="Inet-WAN1" AND src_zone!="Inet-WAN2") (dest_zone!="Inet-WAN1" AND dest_zone!="Inet-WAN2") src_ip != xxx | stats by src_ip, dest_ip, _time | bin _time span=1d | stats count by _time </CODE></PRE> <P>Thanks!</P> Thu, 09 Aug 2018 11:26:36 GMT christianubeda 2018-08-09T11:26:36Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-can-I-do-a-graph-with-multiple-data/m-p/397297#M4424 <P>Hi team!</P> <P>It's my very first time here and I need a bit of help!</P> <P>I want to make a graph with multiple lanes.</P> <P>I have this right now. 1 graph per data. I want to fusion them but I don't know how.</P> <P>Graph 1.</P> <PRE><CODE>index=xxx_paloalto sourcetype="pan:threat" type=threat threat_name="SCAN: TCP Port Scan(8001)" (src_zone!="Inet-WAN1" AND src_zone!="Inet-WAN2") (dest_zone!="Inet-WAN1" AND dest_zone!="Inet-WAN2") src_ip != xxx | stats by src_ip, dest_ip, _time | bin _time span=1d | stats count by _time </CODE></PRE> <P>Graph 2</P> <PRE><CODE>index=xxx_paloalto sourcetype="pan:threat" type=threat threat_name="SCAN: Host Sweep(8002)" (src_zone!="Inet-WAN1" AND src_zone!="Inet-WAN2") (dest_zone!="Inet-WAN1" AND dest_zone!="Inet-WAN2") src_ip != xxx | stats by src_ip, dest_ip, _time | bin _time span=1d | stats count by _time </CODE></PRE> <P>Thanks!</P> Thu, 09 Aug 2018 11:26:36 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-can-I-do-a-graph-with-multiple-data/m-p/397297#M4424 christianubeda 2018-08-09T11:26:36Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-can-I-do-a-graph-with-multiple-data/m-p/397298#M4425 <P>Give this a try. I am assuming you want a line for each combination of src_ip, dest_ip, and threat_name based on your search above. By the way, you are missing a function in your stats command. Something like count, avg, min, max, etc... Either way, I created a field that concatenates the src_ip, dest_ip, and threat_name so you can get a line for each in a line graph for example. I hope this helps.</P> <PRE><CODE>index=xxx_paloalto sourcetype="pan:threat" type=threat (threat_name="SCAN: TCP Port Scan(8001)” OR threat_name=“SCAN: Host Sweep(8002)”) (src_zone!="Inet-WAN1" AND src_zone!="Inet-WAN2") (dest_zone!="Inet-WAN1" AND dest_zone!="Inet-WAN2") src_ip != xxx | eval byfield=src_ip . "," . dest_ip . "," . threat_name | bin _time span=1d | chart count over _time by byfield </CODE></PRE> Tue, 29 Sep 2020 20:50:16 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-can-I-do-a-graph-with-multiple-data/m-p/397298#M4425 kmorris_splunk 2020-09-29T20:50:16Z