Dashboards & Visualizations

reporting on numerous key value pairs in buckets

gdavid
Path Finder

i have the following log data coming in from our spam filter.
ndrscore=0 suspectscore=3 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 adjustscore=0 adultscore=0

i have the fields extracted and now i'm trying to report on them.
how do i create a search to summarize the different types of categories and the count of their values in buckets of 10.
i tried a few things, but nothing it giving my what i'm looking for.

0 Karma

somesoni2
Revered Legend

Give this a try

your base search | table ndrscore suspectscore malwarescore phishscore bulkscore spamscore adjustscore adultscore | eval temp=1 | untable temp score value | stats count by score

OR

your base search | table ndrscore suspectscore malwarescore phishscore bulkscore spamscore adjustscore adultscore | eval temp=1 | untable temp score value | bucket span=10 value| stats count by score value
0 Karma

sundareshr
Legend

What is the desired output? Can you share a mockup?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...