Hey ,
I used sub search and manage to get the results i wanted , however , the splunk dashboard is creating my graphs wrongly. May i know how do i customize it to my needs?
My search command is :
sourcetype="honetnet" [search sourcetype ="honetnet" | top limit=10 SPT | fields SPT] |top limit=3 SRC BY SPT
whereby is search the top 10 SPT (source ports) and then i search the top 3 SRC (source ip addresses) that accessed this ports. But i cant seem to create charts with the results. Any idea? Thanks
Try using appendcols to merge the results together. I've had success with this in the past.
For example:
sourcetype="honetnet" | appendcols [search sourcetype ="honetnet" | top limit=10 SPT | fields SPT] |top limit=3 SRC BY SPT
That might work for you.