topic Re: using bar charts in Splunk Search

using bar charts

moayadalghamdi — Wed, 06 Jan 2021 06:08:44 GMT

Hello splunkers

i want to create a visualization for my command to create a bar chart that contains the (src_ip/user) information on the x-axis and the count on the y-access

i tried this command but it aint working:

i need your help please

Thanks in advance

Re: using bar charts

richgalloway — Wed, 06 Jan 2021 14:14:20 GMT

Please elaborate on "it ain't working". What results do you get and how do they compare to the expected results?

Re: using bar charts

moayadalghamdi — Thu, 07 Jan 2021 05:28:00 GMT

Thanks for the reponse rich ^_^

take a look at this statistics:

now i want to show this table as a bar chart where the combination of (SRC/User) is on the x-axis and the count is on the Y-axis, like:

the y-axis only shows the SRC field, i want to combine it with the user field

Re: using bar charts

admin12345678 — Thu, 07 Jan 2021 07:08:10 GMT

use this in the end of your query

|eval "src.user"=src." :: ".user |fields src.user count

Re: using bar charts

moayadalghamdi — Thu, 07 Jan 2021 07:11:54 GMT

thanks a lot my splunker mate ^_^