Dashboards & Visualizations

How to make a bar graph for two separate search criteria.

cjpizap
Explorer

Hello I would like to make a bar graph that show side by side in one column the results for the total number of clicks blocked based on a certain range of ip addresses and another column that shows the number of clicks blocked not in the specified range of ip addresses. Clicks blocked is a specific value of a field called action. I've tried something like
source = "pp.log" action = "CLKBLK" clickIP ="123.456." or clickIP="789." |stats count as local and this returns the number of clicks blocked but when I try to add in the search for clicks blocked not in those ip ranges I get no results found. Any ideas would be greatly appreciated. I feel like I may just be missing something simple.

0 Karma
1 Solution

lquinn
Contributor

Assuming you want a count of the clicks blocked, split by whether it is in your IP range or not, try using the case command before your count, like this:

source="pp.log"action="CLKBLK" | eval IPType = case(match(clickIP,"123.456"),"InRange",match(clickIP,"789"),"InRange",match(clickIP,"."), "OutOfRange") | stats count by IPType

View solution in original post

gokadroid
Motivator

Please try this query and choose column chart as visualization:

source = "pp.log" action = "CLKBLK" clickIP ="123.456." OR clickIP="789." 
|stats count as local
|eval reportkey="InRange"
| append [search source = "pp.log" action = "CLKBLK" NOT (clickIP ="123.456." OR clickIP="789.")
|stats count as local
|eval reportkey="OutRange"]
| chart max(local) by reportkey

cjpizap
Explorer

This also worked really well so even though I can only accept one answer points for you too. Thanks for the help.

0 Karma

gokadroid
Motivator

@cjpizap - As long as it worked well that's what we answered for. Thanks a lot for up vote !!

0 Karma

lquinn
Contributor

Assuming you want a count of the clicks blocked, split by whether it is in your IP range or not, try using the case command before your count, like this:

source="pp.log"action="CLKBLK" | eval IPType = case(match(clickIP,"123.456"),"InRange",match(clickIP,"789"),"InRange",match(clickIP,"."), "OutOfRange") | stats count by IPType

cjpizap
Explorer

This worked exactly like I needed thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...