Dashboards & Visualizations

Splunk Graph using 4 Fields combination

amgsplunk
Explorer

Hi,

I am looking to plot a graph using four fields in splunk. Looking for relationship  graph among Domain, Category , Ipaddress and Severity similar to excel graph as below.

Sample Data:

DomainCategoryIpaddressSeverity
domain1prod192.168.1.20Low
domain2non-prod192.168.1.21High
domain3prod192.168.1.22Critical
domain3prod192.168.1.22Medium
domain4non-prod192.168.1.23Low
domain1prod192.168.1.20Low
domain2non-prod192.168.1.21High
domain3prod192.168.1.22Critical
domain3prod192.168.1.22Medium
domain4non-prod192.168.1.23Low
domain1prod192.168.1.20Low
domain2non-prod192.168.1.21High
domain3prod192.168.1.22Critical
domain3prod192.168.1.22Medium
domain1prod192.168.1.20High
domain1prod192.168.1.20Critical

 

Graph prepared using excel:

amgsplunk_0-1650337820096.png

 

 

amgsplunk_1-1650338103281.png

Please advise search command to see the relationship in Visualization to plot the graph.

 

Labels (1)
0 Karma
1 Solution

Gr0und_Z3r0
Contributor

Hi @amgsplunk 
Try something with Trellis for your charts and turn on Legends as per your need

| inputlookup test1.csv 
| eval cat = Domain+"-"+Category 
| stats count(eval(Severity="Critical")) as Critical
    count(eval(Severity="High")) as High
    count(eval(Severity="Medium")) as Medium
    count(eval(Severity="Low")) as Low
    by Ipaddress cat



Gr0und_Z3r0_0-1650350469913.png

Gr0und_Z3r0_1-1650350487144.png

 

View solution in original post

0 Karma

Gr0und_Z3r0
Contributor

Hi @amgsplunk 
Try something with Trellis for your charts and turn on Legends as per your need

| inputlookup test1.csv 
| eval cat = Domain+"-"+Category 
| stats count(eval(Severity="Critical")) as Critical
    count(eval(Severity="High")) as High
    count(eval(Severity="Medium")) as Medium
    count(eval(Severity="Low")) as Low
    by Ipaddress cat



Gr0und_Z3r0_0-1650350469913.png

Gr0und_Z3r0_1-1650350487144.png

 

0 Karma

amgsplunk
Explorer

Dear Gr0und_Z3r0,

Thank you very much for the solution.  This is what I am looking.

0 Karma

amgsplunk
Explorer

Thanks for your response. Graph is not showing the severity. 

source="reports_19_1.csv" host="ClassES1" index="mallik_index_local" sourcetype="csv" |eval ipdomain=Domain." - ".Ipaddress
| stats count by ipdomain Category Severity

 

Not getting the desired output.  I want to see domain, Ipaddress, Severity and category in the graph. Severity and Category fields are missing in the graph. The following is the visualization result from splunk search, visualization.

 

 

amgsplunk_0-1650342725695.png

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

As you wrote yourself, it's

<your search>
| stats count by Domain Ipaddress Category Severity

Nothing fancy.

In this case domain maps 1:1 with ipaddress so you might "squeeze" them into one field

<your search>
| eval ipdomain=Domain." - ".Ipaddress
| stats count by ipdomain Category Severity
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...