topic Re: Simple Bubble Chart in Splunk Search

Simple Bubble Chart

rbw78 — Thu, 22 Dec 2011 15:35:39 GMT

Hello.

I'm a newbie on splunk and i need some help for a Bubble Chart.

I want to count the total of matchs between sources and destinations hosts from my logs.
here is a log exemple :

Dec 15 17:22:27 10.233.86.237 Dec 15 17:22:19 LW5YOPDSY dsa_mpf: REASON=Invalid_Ack act=Deny IN=Local_Area_Connection OUT= MAC=F0:DE:F1:34:04:87:00:21:55:EF:8C:7F:08:00 SRC=213.181.36.229 DST=10.233.86.237 LEN=60 DF FRAG=0 PROTO=TCP SPT=16384 DPT=65308 RES=0x00 ACK CNT=1

SRC for source and DST for destination.

I tried to do some xml in my dashboard but i event don't what kind of search i have to do on my logs.

<row>
   <chart>
    <searchName>TestBubbleChart</searchName>
    <title>TestBubbleChart</title>
        <option name="charting.chart">bubble</option>
        <option name="charting.axisX.categories">SRC</option> # Sources on X axe
        <option name="charting.axisY.categories">DST</option> # Destinations on Y axe
        <option name="charting.axisLabelsZ">numeric</option>  # Count the matchs on Z axe 
   </chart>
  </row>

thanks for your help.

Re: Simple Bubble Chart

rbw78 — Fri, 23 Dec 2011 08:01:49 GMT

Anyone know how to do that ?

Re: Simple Bubble Chart

rbw78 — Fri, 23 Dec 2011 09:27:57 GMT

Well my xml file look like this :

<row>
   <chart>
    <searchName>TestBubbleChart</searchName>
    <title>TestBubbleChart</title>
        <option name="charting.chart">bubble</option>
        <option name="charting.axisX">SRC</option>
        <option name="charting.axisY">DST</option>
        <option name="charting.axisZ">numeric</option>
        <option name="charting.axisZ.minimumNumber">0</option>
        <option name="charting.axisZ.maximumNumber">1000</option>
   </chart>
  </row>

I did the following search on my logs but still no result

eventtype="EVENT_DSA" | rex "(?i) .*?=(?P<SRC>\d+\.\d+\.\d+\.\d+)(?= )" | rex "(?i) dst=(?P<DST>[^ ]+)"

Re: Simple Bubble Chart

rbw78 — Mon, 02 Jan 2012 10:51:45 GMT

Still no one could help on this topic ?

😞

Re: Simple Bubble Chart

MarioM — Mon, 11 Jun 2012 19:02:58 GMT

could you explain a bit more what you mean by "count the total of matchs between sources and destinations"? what is your search command ie:"| stats dc(SRC) dc(DST)" ?