Dashboards & Visualizations

Splunk Graph using 4 Fields combination

amgsplunk
Explorer

Hi,

I am looking to plot a graph using four fields in splunk. Looking for relationship  graph among Domain, Category , Ipaddress and Severity similar to excel graph as below.

Sample Data:

DomainCategoryIpaddressSeverity
domain1prod192.168.1.20Low
domain2non-prod192.168.1.21High
domain3prod192.168.1.22Critical
domain3prod192.168.1.22Medium
domain4non-prod192.168.1.23Low
domain1prod192.168.1.20Low
domain2non-prod192.168.1.21High
domain3prod192.168.1.22Critical
domain3prod192.168.1.22Medium
domain4non-prod192.168.1.23Low
domain1prod192.168.1.20Low
domain2non-prod192.168.1.21High
domain3prod192.168.1.22Critical
domain3prod192.168.1.22Medium
domain1prod192.168.1.20High
domain1prod192.168.1.20Critical

 

Graph prepared using excel:

amgsplunk_0-1650337820096.png

 

 

amgsplunk_1-1650338103281.png

Please advise search command to see the relationship in Visualization to plot the graph.

 

Labels (1)
0 Karma
1 Solution

Gr0und_Z3r0
Contributor

Hi @amgsplunk 
Try something with Trellis for your charts and turn on Legends as per your need

| inputlookup test1.csv 
| eval cat = Domain+"-"+Category 
| stats count(eval(Severity="Critical")) as Critical
    count(eval(Severity="High")) as High
    count(eval(Severity="Medium")) as Medium
    count(eval(Severity="Low")) as Low
    by Ipaddress cat



Gr0und_Z3r0_0-1650350469913.png

Gr0und_Z3r0_1-1650350487144.png

 

View solution in original post

0 Karma

Gr0und_Z3r0
Contributor

Hi @amgsplunk 
Try something with Trellis for your charts and turn on Legends as per your need

| inputlookup test1.csv 
| eval cat = Domain+"-"+Category 
| stats count(eval(Severity="Critical")) as Critical
    count(eval(Severity="High")) as High
    count(eval(Severity="Medium")) as Medium
    count(eval(Severity="Low")) as Low
    by Ipaddress cat



Gr0und_Z3r0_0-1650350469913.png

Gr0und_Z3r0_1-1650350487144.png

 

0 Karma

amgsplunk
Explorer

Dear Gr0und_Z3r0,

Thank you very much for the solution.  This is what I am looking.

0 Karma

amgsplunk
Explorer

Thanks for your response. Graph is not showing the severity. 

source="reports_19_1.csv" host="ClassES1" index="mallik_index_local" sourcetype="csv" |eval ipdomain=Domain." - ".Ipaddress
| stats count by ipdomain Category Severity

 

Not getting the desired output.  I want to see domain, Ipaddress, Severity and category in the graph. Severity and Category fields are missing in the graph. The following is the visualization result from splunk search, visualization.

 

 

amgsplunk_0-1650342725695.png

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

As you wrote yourself, it's

<your search>
| stats count by Domain Ipaddress Category Severity

Nothing fancy.

In this case domain maps 1:1 with ipaddress so you might "squeeze" them into one field

<your search>
| eval ipdomain=Domain." - ".Ipaddress
| stats count by ipdomain Category Severity
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...