Dashboards & Visualizations

reporting on numerous key value pairs in buckets

gdavid
Path Finder

i have the following log data coming in from our spam filter.
ndrscore=0 suspectscore=3 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 adjustscore=0 adultscore=0

i have the fields extracted and now i'm trying to report on them.
how do i create a search to summarize the different types of categories and the count of their values in buckets of 10.
i tried a few things, but nothing it giving my what i'm looking for.

0 Karma

somesoni2
Revered Legend

Give this a try

your base search | table ndrscore suspectscore malwarescore phishscore bulkscore spamscore adjustscore adultscore | eval temp=1 | untable temp score value | stats count by score

OR

your base search | table ndrscore suspectscore malwarescore phishscore bulkscore spamscore adjustscore adultscore | eval temp=1 | untable temp score value | bucket span=10 value| stats count by score value
0 Karma

sundareshr
Legend

What is the desired output? Can you share a mockup?

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...