All Apps and Add-ons

Is it possible to use wildcards with Flow Map Viz

nathanluke86
Communicator

Is it possible to have multiple fields using wildcards as follows:

index = iis sourcetype="ms:iis:auto"
| stats count(eval(status=4*)) as error count(eval(status=2*)) as good by dest_ip
|eval from="Traffic" , to= dest_ip
|head 100
|table from to error good

I have also tried:

index = iis sourcetype="ms:iis:auto"
| stats count(eval(status=400 and 401 and 402))

But can't seem get this to work

Any help would be appreciated

I am also wondering if there is an example search plus lookup (maybe a generic _internal search |lookup) as mentioned in the documentation that can be used to help explain in more detail how the search and lookup works for complex flow maps. I am having difficulty with combining the two.

Thanks in advance, @chrisyoungerjds , loving this app by the way 5*

Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
index = iis sourcetype="ms:iis:auto"
| chart useother=false usenull=false count over dest_ip by status
| streamstats count as tmp
| untable tmp status count
| stats sum(eval(if(like(status,"2%"),count,0))) as good 
,sum(eval(if(like(status,"4%"),count,0))) as error
,values(eval(if(status=="dest_ip",count,NULL))) as dest_ip  by tmp
| eval from="Traffic", to=dest_ip
| fields from to error good

OR

index = iis sourcetype="ms:iis:auto"
| chart  useother=false usenull=false count over dest_ip by status
| eval good=0,error=0
| foreach 2* 
    [eval good = good + '<<FIELD>>']
| foreach 4* 
    [eval error = error + '<<FIELD>>']
| eval from="Traffic", to=dest_ip
| fields from to error good

Hi, how about this?

View solution in original post

to4kawa
Ultra Champion
index = iis sourcetype="ms:iis:auto"
| chart useother=false usenull=false count over dest_ip by status
| streamstats count as tmp
| untable tmp status count
| stats sum(eval(if(like(status,"2%"),count,0))) as good 
,sum(eval(if(like(status,"4%"),count,0))) as error
,values(eval(if(status=="dest_ip",count,NULL))) as dest_ip  by tmp
| eval from="Traffic", to=dest_ip
| fields from to error good

OR

index = iis sourcetype="ms:iis:auto"
| chart  useother=false usenull=false count over dest_ip by status
| eval good=0,error=0
| foreach 2* 
    [eval good = good + '<<FIELD>>']
| foreach 4* 
    [eval error = error + '<<FIELD>>']
| eval from="Traffic", to=dest_ip
| fields from to error good

Hi, how about this?

nathanluke86
Communicator

Thanks @to4kawa for the prompt reply.

This worked a treat, I will just need to change good/error to success/error now,

Again, thanks for the support.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...