Dashboards & Visualizations

reporting on numerous key value pairs in buckets

Path Finder

i have the following log data coming in from our spam filter.
ndrscore=0 suspectscore=3 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 adjustscore=0 adultscore=0

i have the fields extracted and now i'm trying to report on them.
how do i create a search to summarize the different types of categories and the count of their values in buckets of 10.
i tried a few things, but nothing it giving my what i'm looking for.

0 Karma

SplunkTrust
SplunkTrust

Give this a try

your base search | table ndrscore suspectscore malwarescore phishscore bulkscore spamscore adjustscore adultscore | eval temp=1 | untable temp score value | stats count by score

OR

your base search | table ndrscore suspectscore malwarescore phishscore bulkscore spamscore adjustscore adultscore | eval temp=1 | untable temp score value | bucket span=10 value| stats count by score value
0 Karma

Legend

What is the desired output? Can you share a mockup?

0 Karma