Dashboards & Visualizations

Timeline creation using eval case function

Denorsmith
Engager

I am trying to make a timeline showing different response code ranges being defined. This is the eval I am using, and I want to add the 4 different categories into a timeline dashboard panel.

index="stuff" sourcetype="things" src_ip="1.1.1.1" dest_ip="2.2.2.2"
| search TERM(attack_vector)
| eval Status = case(response_code>="400" OR response_code="0", "Blocked", response_code>="202" AND response_code<="226", "Partial", response_code>="300" AND response_code<="399", "Redirect", response_code="200" OR response_code="201", "Success")

I cannot for the life of me figure out what I need to put in the "stats" and "table" portion to make it show a line for each of the created categories! 

Labels (4)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @Denorsmith ,

Please try below; (I also

index="stuff" sourcetype="things" src_ip="1.1.1.1" dest_ip="2.2.2.2" TERM(attack_vector)
| eval Status = case(response_code>="400" OR response_code="0", "Blocked", response_code>="202" AND response_code<="226", "Partial", response_code>="300" AND response_code<="399", "Redirect", response_code="200" OR response_code="201", "Success")
| timechart count by Status

removed search term before TERM for faster results)

 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @Denorsmith ,

Please try below; (I also

index="stuff" sourcetype="things" src_ip="1.1.1.1" dest_ip="2.2.2.2" TERM(attack_vector)
| eval Status = case(response_code>="400" OR response_code="0", "Blocked", response_code>="202" AND response_code<="226", "Partial", response_code>="300" AND response_code<="399", "Redirect", response_code="200" OR response_code="201", "Success")
| timechart count by Status

removed search term before TERM for faster results)

 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...