https://community.splunk.com/t5/Splunk-Search/How-to-create-pie-charts-for-the-top-10-firewall-events-based-on/m-p/152173#M42656 <P>I'm just starting to experiment with some cool searches for my firewall events. I've created this customized search that will sort by src_ip and display other fields of interest in table form. I've used the time presets to create reports and dashboards for day, week, month and year.</P> <PRE><CODE>index="main" sourcetype="syslog" | stats count by src_ip,src_port,dest_ip,dest_port,protocol,action | sort -count </CODE></PRE> <P>I'm looking for help on creating some cool pie charts for top 10 events based on the aforementioned time frame's filtered by different criteria such as src_ip or action (pass/block). </P> <P>Much appreciated!</P> Mon, 06 Oct 2014 01:41:19 GMT WWhite 2014-10-06T01:41:19Z https://community.splunk.com/t5/Splunk-Search/How-to-create-pie-charts-for-the-top-10-firewall-events-based-on/m-p/152173#M42656 <P>I'm just starting to experiment with some cool searches for my firewall events. I've created this customized search that will sort by src_ip and display other fields of interest in table form. I've used the time presets to create reports and dashboards for day, week, month and year.</P> <PRE><CODE>index="main" sourcetype="syslog" | stats count by src_ip,src_port,dest_ip,dest_port,protocol,action | sort -count </CODE></PRE> <P>I'm looking for help on creating some cool pie charts for top 10 events based on the aforementioned time frame's filtered by different criteria such as src_ip or action (pass/block). </P> <P>Much appreciated!</P> Mon, 06 Oct 2014 01:41:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-pie-charts-for-the-top-10-firewall-events-based-on/m-p/152173#M42656 WWhite 2014-10-06T01:41:19Z https://community.splunk.com/t5/Splunk-Search/How-to-create-pie-charts-for-the-top-10-firewall-events-based-on/m-p/152174#M42657 <P>OK<BR /> If you are already able to make a search as you did, Producing a pie chart will be easy.</P> <P>just make sur that you filter your search as you like and at the end to have the top 10 you add this:</P> <P><STRONG>| top limit=10 action</STRONG> </P> <P>if you are in the splunk default search view , clic on visualization then choose pie in the dropdown menu beside format. </P> Fri, 12 Dec 2014 13:00:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-pie-charts-for-the-top-10-firewall-events-based-on/m-p/152174#M42657 stephane_cyrill 2014-12-12T13:00:41Z https://community.splunk.com/t5/Splunk-Search/How-to-create-pie-charts-for-the-top-10-firewall-events-based-on/m-p/152175#M42658 <P>for the search you did you can have a pie</P> <P>index="main" sourcetype="syslog" | stats count by src_ip,src_port,dest_ip,dest_port,protocol,action | sort -count|top 10 </P> <P>the general syntaxe of the top commande is: <STRONG>top top-option fiel-list [by-clause]</STRONG> </P> <P>see Splunk Enterprise 6x Search Reference for more on the command.</P> Mon, 28 Sep 2020 18:21:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-pie-charts-for-the-top-10-firewall-events-based-on/m-p/152175#M42658 stephane_cyrill 2020-09-28T18:21:57Z