Splunk Enterprise Security

Change Data Presentation in Single Value Visualization

moayadalghamdi
Path Finder

Hello Splunkers.

i made a splunk search to count the number of blocked URLs as a single value in a one day span of 3days period of search.

 

here's my search: 

index=proxy action=blocked
| bin _time span=1d
| stats count(http_url) by _time

 

and here's the results:

moayadalghamdi_1-1627810544399.png

 

i want to show it in thousands of tried, i tried this this search but the results doesnt appear: 

index=proxy action=blocked
| bin _time span=1d
| eval url_count= http_url/1000
| stats count(url_count) by _time

 

but there are no results

moayadalghamdi_2-1627810683161.png

 

 

please help me with it,  thanks ^_^

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@moayadalghamdi 

try this.

index=proxy action=blocked
| bin _time span=1d
| stats count(http_url) as http_url_count by _time
| eval http_url_count=http_url_count/1000
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...