Hi,
I am looking to plot a graph using four fields in splunk. Looking for relationship graph among Domain, Category , Ipaddress and Severity similar to excel graph as below.
Sample Data:
Domain | Category | Ipaddress | Severity |
domain1 | prod | 192.168.1.20 | Low |
domain2 | non-prod | 192.168.1.21 | High |
domain3 | prod | 192.168.1.22 | Critical |
domain3 | prod | 192.168.1.22 | Medium |
domain4 | non-prod | 192.168.1.23 | Low |
domain1 | prod | 192.168.1.20 | Low |
domain2 | non-prod | 192.168.1.21 | High |
domain3 | prod | 192.168.1.22 | Critical |
domain3 | prod | 192.168.1.22 | Medium |
domain4 | non-prod | 192.168.1.23 | Low |
domain1 | prod | 192.168.1.20 | Low |
domain2 | non-prod | 192.168.1.21 | High |
domain3 | prod | 192.168.1.22 | Critical |
domain3 | prod | 192.168.1.22 | Medium |
domain1 | prod | 192.168.1.20 | High |
domain1 | prod | 192.168.1.20 | Critical |
Graph prepared using excel:
Please advise search command to see the relationship in Visualization to plot the graph.
Hi @amgsplunk
Try something with Trellis for your charts and turn on Legends as per your need
| inputlookup test1.csv
| eval cat = Domain+"-"+Category
| stats count(eval(Severity="Critical")) as Critical
count(eval(Severity="High")) as High
count(eval(Severity="Medium")) as Medium
count(eval(Severity="Low")) as Low
by Ipaddress cat
Hi @amgsplunk
Try something with Trellis for your charts and turn on Legends as per your need
| inputlookup test1.csv
| eval cat = Domain+"-"+Category
| stats count(eval(Severity="Critical")) as Critical
count(eval(Severity="High")) as High
count(eval(Severity="Medium")) as Medium
count(eval(Severity="Low")) as Low
by Ipaddress cat
Dear Gr0und_Z3r0,
Thank you very much for the solution. This is what I am looking.
Thanks for your response. Graph is not showing the severity.
source="reports_19_1.csv" host="ClassES1" index="mallik_index_local" sourcetype="csv" |eval ipdomain=Domain." - ".Ipaddress
| stats count by ipdomain Category Severity
Not getting the desired output. I want to see domain, Ipaddress, Severity and category in the graph. Severity and Category fields are missing in the graph. The following is the visualization result from splunk search, visualization.
As you wrote yourself, it's
<your search>
| stats count by Domain Ipaddress Category Severity
Nothing fancy.
In this case domain maps 1:1 with ipaddress so you might "squeeze" them into one field
<your search>
| eval ipdomain=Domain." - ".Ipaddress
| stats count by ipdomain Category Severity