Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: adding a collum in a "...| chart count by x"
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
my querry
'sourcetype="xxx" radius authentication failed | chart count by user | sort - count'
gives me a nice little chart und a table under it. My problem is that i can not add an additional collum "NAS_IP_Adress".
can you give me any tips? thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can update your table like you described using following search:
sourcetype="xxx" radius authentication failed | stats count by user NAS_IP | sort - count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can update your table like you described using following search:
sourcetype="xxx" radius authentication failed | stats count by user NAS_IP | sort - count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
perfect, thank you!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad this fulfilled your requirement. Don't forget to close the question by accepting this answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It'll depend upon what your final output is going to look like. Can you post some mock table output or describe how your chart should look like with your NAS_IP_ADDRESS field?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the chart only show you the users and the number of events of each user.
the table should show you user,NAS_IP, count(user)
there can only be one NAS_IP for each user
Index This | When is October more than just the tenth month?
Observe and Secure All Apps with Splunk
What’s New & Next in Splunk SOAR
