Dashboards & Visualizations

reporting on numerous key value pairs in buckets

gdavid
Path Finder

i have the following log data coming in from our spam filter.
ndrscore=0 suspectscore=3 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 adjustscore=0 adultscore=0

i have the fields extracted and now i'm trying to report on them.
how do i create a search to summarize the different types of categories and the count of their values in buckets of 10.
i tried a few things, but nothing it giving my what i'm looking for.

0 Karma

somesoni2
Revered Legend

Give this a try

your base search | table ndrscore suspectscore malwarescore phishscore bulkscore spamscore adjustscore adultscore | eval temp=1 | untable temp score value | stats count by score

OR

your base search | table ndrscore suspectscore malwarescore phishscore bulkscore spamscore adjustscore adultscore | eval temp=1 | untable temp score value | bucket span=10 value| stats count by score value
0 Karma

sundareshr
Legend

What is the desired output? Can you share a mockup?

0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...