Timeline creation using eval case function

Denorsmith — Fri, 13 Aug 2021 00:26:02 GMT

I am trying to make a timeline showing different response code ranges being defined. This is the eval I am using, and I want to add the 4 different categories into a timeline dashboard panel.

index="stuff" sourcetype="things" src_ip="1.1.1.1" dest_ip="2.2.2.2"
| search TERM(attack_vector)
| eval Status = case(response_code>="400" OR response_code="0", "Blocked", response_code>="202" AND response_code<="226", "Partial", response_code>="300" AND response_code<="399", "Redirect", response_code="200" OR response_code="201", "Success")

I cannot for the life of me figure out what I need to put in the "stats" and "table" portion to make it show a line for each of the created categories!

Re: Timeline creation using eval case function

scelikok — Fri, 13 Aug 2021 05:06:59 GMT

Hi @Denorsmith ,

Please try below; (I also

index="stuff" sourcetype="things" src_ip="1.1.1.1" dest_ip="2.2.2.2" TERM(attack_vector) | eval Status = case(response_code>="400" OR response_code="0", "Blocked", response_code>="202" AND response_code<="226", "Partial", response_code>="300" AND response_code<="399", "Redirect", response_code="200" OR response_code="201", "Success") | timechart count by Status

removed search term before TERM for faster results)

topic Timeline creation using eval case function in Dashboards & Visualizations

Timeline creation using eval case function

Re: Timeline creation using eval case function