Dashboards & Visualizations

Visual Dashboard using 4 fields in Stats count

jeish99
Engager

I'm trying to create a visual dashboard  (specifically a column graph or bar chart) using 

index=guardium ruleDesc="OS Command Injection"
| stats count by dbUser, DBName, serviceName, sql

 

This is the graph I get:

Screenshot (47).png

I would like to group these fields into categories on the chart where one part would show count of 1-5 then 6-10...and so on.  Then I could drill down a specific bar within the count group to view the fields for that bar in a table format.  How would I go about doing this.  I am new to splunk and have been stuck finding the best way to represent this data.  I was given this search statement and was told to make a visual dashboard of it.

Labels (2)
0 Karma
1 Solution

fredclown
Builder

You would do a second stats to roll them up like this ...

index=guardium ruleDesc="OS Command Injection"
| stats count by dbUser, DBName, serviceName, sql
| eval category = case(
    count < 6, "1-5",
    count < 11, "6-10",
    count < 16, "11-15",
    1==1, "16+"
)
| stats count by category

Then you would set up a drilldown on the chart to pass a token to another search and limit it based on the token..

View solution in original post

0 Karma

fredclown
Builder

You would do a second stats to roll them up like this ...

index=guardium ruleDesc="OS Command Injection"
| stats count by dbUser, DBName, serviceName, sql
| eval category = case(
    count < 6, "1-5",
    count < 11, "6-10",
    count < 16, "11-15",
    1==1, "16+"
)
| stats count by category

Then you would set up a drilldown on the chart to pass a token to another search and limit it based on the token..

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...