Archive

adding a collum in a "...| chart count by x"

New Member

Hello,
my querry
'sourcetype="xxx" radius authentication failed | chart count by user | sort - count'
gives me a nice little chart und a table under it. My problem is that i can not add an additional collum "NASIPAdress".

can you give me any tips? thanks

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

You can update your table like you described using following search:

sourcetype="xxx" radius authentication failed | stats count by user NAS_IP | sort - count

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

You can update your table like you described using following search:

sourcetype="xxx" radius authentication failed | stats count by user NAS_IP | sort - count

View solution in original post

0 Karma

New Member

perfect, thank you!!

0 Karma

SplunkTrust
SplunkTrust

Glad this fulfilled your requirement. Don't forget to close the question by accepting this answer.

0 Karma

SplunkTrust
SplunkTrust

It'll depend upon what your final output is going to look like. Can you post some mock table output or describe how your chart should look like with your NASIPADDRESS field?

0 Karma

New Member

the chart only show you the users and the number of events of each user.
the table should show you user,NAS_IP, count(user)

there can only be one NAS_IP for each user

0 Karma