All Apps and Add-ons

How to create a chart with sub search results

cheukkay
Engager

Hey ,
I used sub search and manage to get the results i wanted , however , the splunk dashboard is creating my graphs wrongly. May i know how do i customize it to my needs?

My search command is :
sourcetype="honetnet" [search sourcetype ="honetnet" | top limit=10 SPT | fields SPT] |top limit=3 SRC BY SPT

whereby is search the top 10 SPT (source ports) and then i search the top 3 SRC (source ip addresses) that accessed this ports. But i cant seem to create charts with the results. Any idea? Thanks

0 Karma

jtrucks
Splunk Employee
Splunk Employee

Try using appendcols to merge the results together. I've had success with this in the past.

For example:

sourcetype="honetnet" | appendcols [search sourcetype ="honetnet" | top limit=10 SPT | fields SPT] |top limit=3 SRC BY SPT

That might work for you.

--
Jesse Trucks
Minister of Magic
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...