https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/610948#M212462 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/228495">@janroc</a>,</P><P>if you have "dst_src" in the eval command, you have to use the same field name also in the stats command and not "dstsrc".</P><P>Ciao.</P><P>Giuseppe</P> Fri, 26 Aug 2022 12:35:18 GMT gcusello 2022-08-26T12:35:18Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/610921#M212452 <P>Hi all,<BR /><BR />How do I get two fileds "ip numbers" in an timechart?<BR />I tried the aggregate fileds, but show up wrong in my visualisation of showing src and dst ip.<BR /><BR /></P> <LI-CODE lang="markup">index=firewall dest_ip=* src=* dest_port=8090 action=blocked | eval dstsrc=dest_ip . src | timechart count by dstsrc</LI-CODE> <P>Regards Jan</P> Fri, 26 Aug 2022 11:00:39 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/610921#M212452 janroc 2022-08-26T11:00:39Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/610923#M212453 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/228495">@janroc</a>,</P><P>what's the issue? have you results without executing the timechart command?</P><P>in other words are there events that match all the conditions (<SPAN>index=firewall dest_ip=* src=* dest_port=8090 action=blocked)?</SPAN></P><P><SPAN>And all events have both the fields with a not null value?</SPAN></P><P><SPAN>Anyway, your approach is correct, The only thing is that I don't like to have attached ip values, I'd use</SPAN></P><LI-CODE lang="markup">index=firewall dest_ip=* src=* dest_port=8090 action=blocked | eval dst_src=dest_ip."|".src | timechart count by dst_src</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Fri, 26 Aug 2022 08:13:57 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/610923#M212453 gcusello 2022-08-26T08:13:57Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/610928#M212454 <P>The ip numbers should show up as 1.1.1.1 2.2.2.2 but showing as 1.1.1.12.2.2.2</P> Fri, 26 Aug 2022 08:54:54 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/610928#M212454 janroc 2022-08-26T08:54:54Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/610929#M212455 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/228495">@janroc</a>,</P><P>as I said, if you want a sapce between the two IPs you have to add it:</P><LI-CODE lang="markup">| eval dst_src=dest_ip." ".src</LI-CODE><P>if you put dest_ip.src you make one field but without space between IPs.</P><P>Ciao.</P><P>Giuseppe</P> Fri, 26 Aug 2022 09:11:15 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/610929#M212455 gcusello 2022-08-26T09:11:15Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/610940#M212460 <P>Hi,</P><P>This will only give me a lot of NULL values now.</P><P>-J-</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="janroc_0-1661510158132.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/21197iC65804A6E29A57B7/image-size/medium?v=v2&amp;px=400" role="button" title="janroc_0-1661510158132.png" alt="janroc_0-1661510158132.png" /></span></P><P>&nbsp;</P> Fri, 26 Aug 2022 10:36:11 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/610940#M212460 janroc 2022-08-26T10:36:11Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/610948#M212462 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/228495">@janroc</a>,</P><P>if you have "dst_src" in the eval command, you have to use the same field name also in the stats command and not "dstsrc".</P><P>Ciao.</P><P>Giuseppe</P> Fri, 26 Aug 2022 12:35:18 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/610948#M212462 gcusello 2022-08-26T12:35:18Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/610953#M212463 <P>My fault of typo, thank you <span class="lia-unicode-emoji" title=":neutral_face:">😐</span></P> Fri, 26 Aug 2022 13:11:33 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/610953#M212463 janroc 2022-08-26T13:11:33Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/611042#M212475 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/228495">@janroc</a>,</P><P>good for you, see next time!</P><P>Please accept one answer for the other people of Community</P><P>Ciao and happy splunking</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Sat, 27 Aug 2022 08:46:27 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-two-fileds-quot-ip-numbers-quot-in-an-timechart/m-p/611042#M212475 gcusello 2022-08-27T08:46:27Z