Dashboards & Visualizations

adding a collum in a "...| chart count by x"

Aufex
Explorer

Hello,
my querry
'sourcetype="xxx" radius authentication failed | chart count by user | sort - count'
gives me a nice little chart und a table under it. My problem is that i can not add an additional collum "NAS_IP_Adress".

can you give me any tips? thanks

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

You can update your table like you described using following search:

sourcetype="xxx" radius authentication failed | stats count by user NAS_IP | sort - count

View solution in original post

0 Karma

somesoni2
Revered Legend

You can update your table like you described using following search:

sourcetype="xxx" radius authentication failed | stats count by user NAS_IP | sort - count
0 Karma

Aufex
Explorer

perfect, thank you!!

0 Karma

somesoni2
Revered Legend

Glad this fulfilled your requirement. Don't forget to close the question by accepting this answer.

0 Karma

somesoni2
Revered Legend

It'll depend upon what your final output is going to look like. Can you post some mock table output or describe how your chart should look like with your NAS_IP_ADDRESS field?

0 Karma

Aufex
Explorer

the chart only show you the users and the number of events of each user.
the table should show you user,NAS_IP, count(user)

there can only be one NAS_IP for each user

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...