Dashboards & Visualizations

Timeline creation using eval case function

Denorsmith
Engager

I am trying to make a timeline showing different response code ranges being defined. This is the eval I am using, and I want to add the 4 different categories into a timeline dashboard panel.

index="stuff" sourcetype="things" src_ip="1.1.1.1" dest_ip="2.2.2.2"
| search TERM(attack_vector)
| eval Status = case(response_code>="400" OR response_code="0", "Blocked", response_code>="202" AND response_code<="226", "Partial", response_code>="300" AND response_code<="399", "Redirect", response_code="200" OR response_code="201", "Success")

I cannot for the life of me figure out what I need to put in the "stats" and "table" portion to make it show a line for each of the created categories! 

Labels (4)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @Denorsmith ,

Please try below; (I also

index="stuff" sourcetype="things" src_ip="1.1.1.1" dest_ip="2.2.2.2" TERM(attack_vector)
| eval Status = case(response_code>="400" OR response_code="0", "Blocked", response_code>="202" AND response_code<="226", "Partial", response_code>="300" AND response_code<="399", "Redirect", response_code="200" OR response_code="201", "Success")
| timechart count by Status

removed search term before TERM for faster results)

 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @Denorsmith ,

Please try below; (I also

index="stuff" sourcetype="things" src_ip="1.1.1.1" dest_ip="2.2.2.2" TERM(attack_vector)
| eval Status = case(response_code>="400" OR response_code="0", "Blocked", response_code>="202" AND response_code<="226", "Partial", response_code>="300" AND response_code<="399", "Redirect", response_code="200" OR response_code="201", "Success")
| timechart count by Status

removed search term before TERM for faster results)

 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...