How to create a chart with sub search results

[cheukkay]

Hey ,
I used sub search and manage to get the results i wanted , however , the splunk dashboard is creating my graphs wrongly. May i know how do i customize it to my needs?

My search command is :
sourcetype="honetnet" [search sourcetype ="honetnet" | top limit=10 SPT | fields SPT] |top limit=3 SRC BY SPT

whereby is search the top 10 SPT (source ports) and then i search the top 3 SRC (source ip addresses) that accessed this ports. But i cant seem to create charts with the results. Any idea? Thanks

[jtrucks]

Try using appendcols to merge the results together. I've had success with this in the past.

For example:

sourcetype="honetnet" | appendcols [search sourcetype ="honetnet" | top limit=10 SPT | fields SPT] |top limit=3 SRC BY SPT

That might work for you.