Dashboards & Visualizations

adding a collum in a "...| chart count by x"

Aufex
Explorer

Hello,
my querry
'sourcetype="xxx" radius authentication failed | chart count by user | sort - count'
gives me a nice little chart und a table under it. My problem is that i can not add an additional collum "NAS_IP_Adress".

can you give me any tips? thanks

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

You can update your table like you described using following search:

sourcetype="xxx" radius authentication failed | stats count by user NAS_IP | sort - count

View solution in original post

0 Karma

somesoni2
Revered Legend

You can update your table like you described using following search:

sourcetype="xxx" radius authentication failed | stats count by user NAS_IP | sort - count
0 Karma

Aufex
Explorer

perfect, thank you!!

0 Karma

somesoni2
Revered Legend

Glad this fulfilled your requirement. Don't forget to close the question by accepting this answer.

0 Karma

somesoni2
Revered Legend

It'll depend upon what your final output is going to look like. Can you post some mock table output or describe how your chart should look like with your NAS_IP_ADDRESS field?

0 Karma

Aufex
Explorer

the chart only show you the users and the number of events of each user.
the table should show you user,NAS_IP, count(user)

there can only be one NAS_IP for each user

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...