Dashboards & Visualizations

Creating count by chart, but need additional field that only occurs once.

Motivator

I'm trying to create a search to populate a chart with event count by conn number, but also include the value from the extracted field dn, which only occurs once per conn number.

Example data:

[07/Feb/2012:11:30:52 -0800] conn=1021540 op=-1 msgId=-1 - fd=107 slot=107 LDAP connection from 172.21.73.13 to 172.21.64.40
[07/Feb/2012:11:30:52 -0800] conn=1021540 op=0 msgId=1 - BIND dn="uid=jbrown2,ou=people,o=domain,c=com" method=128 version=2
[07/Feb/2012:11:30:52 -0800] conn=1021540 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=jbrown2,ou=people,o=domain,c=com"
[07/Feb/2012:11:30:52 -0800] conn=1021540 op=1 msgId=2 - SRCH base="ou=people,o=domain,c=com" scope=2 filter="(|(uid=Kathy*User*)(cn=Kathy*User*))" attrs=ALL
[07/Feb/2012:11:30:52 -0800] conn=1021540 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[07/Feb/2012:11:30:52 -0800] conn=1021540 op=2 msgId=3 - SRCH base="ou=groups,o=domain,c=com" scope=2 filter="(cn=Kathy*User*)" attrs="*"
[07/Feb/2012:11:30:52 -0800] conn=1021540 op=2 msgId=3 - RESULT err=0 tag=101 nentries=0 etime=0
[07/Feb/2012:11:30:52 -0800] conn=1021540 op=3 msgId=4 - SRCH base="cn=kathy User,ou=people,o=domain,c=com" scope=2 filter="(objectClass=*)" attrs=ALL
[07/Feb/2012:11:30:52 -0800] conn=1021540 op=3 msgId=4 - RESULT err=0 tag=101 nentries=1 etime=0
[07/Feb/2012:11:30:53 -0800] conn=1021540 op=4 msgId=5 - SRCH base="ou=groups,o=domain,c=com" scope=2 filter="(uniqueMember=cn=Kathy User, ou=People, o=domain, c=com)" attrs=ALL
[07/Feb/2012:11:30:53 -0800] conn=1021540 op=4 msgId=5 - RESULT err=0 tag=101 nentries=0 etime=0
[07/Feb/2012:11:30:53 -0800] conn=1021540 op=5 msgId=6 - UNBIND
[07/Feb/2012:11:30:53 -0800] conn=1021540 op=5 msgId=-1 - closing - U1
[07/Feb/2012:11:30:53 -0800] conn=1021540 op=-1 msgId=-1 - closed.

So, end results to be something like:
conn Count BIND dn


10035 305 uid=jbrown2,ou=people,o=domain,c=com
14842 5238 uid=my_app_account,ou=people,o=domain,c=com

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

... | stats count, values(dn) by conn

View solution in original post

Splunk Employee
Splunk Employee

... | stats count, values(dn) by conn

View solution in original post

Motivator

Thanks, now just need to fix or create a new field extraction since there's more dn= than I'd expected in the data.

0 Karma

New Member

How can you calculate search count by dn above and create a time chart??

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!