Dashboards & Visualizations

Dashboard HTTP user agent vs Time

acedeno
Explorer

Hi Everyone, I trying to created a Dashboard that will only shows Allowed traffic from a specific sourtcetype (ie. squid), with the MIME Type anything related to java ONLY and the x_wbrs_score < -3.5 and > -5.9

Then with that information, put together a graphic that shows HTTP user agent vs Time which refreshes every hour for the previous hours traffic. Line based chart/or plotted is preferred.

Thanks in advanced.

So far what I got is this.... but I'm not sure that is want I need.

index="outside" sourcetype="squid" | eval cs_mime_type=lower(cs_mime_type)| search cs_mime_type=java OR cs_mime_type=json x_wbrs_score<-3.5 x_wbrs_score>-5.9 earliest = -1h | eval _time = strptime(time, "%Y-%m-%d") | search * earliest=-1h

0 Karma

pietervi
Path Finder

Hi,

You can optimize your search in some ways:

index="outside" sourcetype="squid" x_wbrs_score<-3.5 x_wbrs_score>-5.9 earliest = -1h@h latest=@h | eval cs_mime_type=lower(cs_mime_type)| search cs_mime_type=java OR cs_mime_type=json  | timechart count by cs_user_agent
earliest=-1h@h latest=@h

This makes sure you only get exactly one hour of data

timechart count by cs_user_agent

Shows the count of requests by User agent

I've also moved the x_wbrs_score filter to the beginning of your search, I'm not really sure if this will work. But in general it's better to filter out the not needed data. That your search should be a bit faster.

The visualization is something you'll have to configure in the dashboard. Also the refreshing is something that should be done in the dashboard.
I've also assumed that the field that has the user agent is cs_user_agent.
You'll have to modify it if needed.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...