Splunk Enterprise Security

Change Data Presentation in Single Value Visualization

Path Finder

Hello Splunkers.

i made a splunk search to count the number of blocked URLs as a single value in a one day span of 3days period of search.


here's my search: 

index=proxy action=blocked
| bin _time span=1d
| stats count(http_url) by _time


and here's the results:



i want to show it in thousands of tried, i tried this this search but the results doesnt appear: 

index=proxy action=blocked
| bin _time span=1d
| eval url_count= http_url/1000
| stats count(url_count) by _time


but there are no results




please help me with it,  thanks ^_^

Labels (1)
0 Karma



try this.

index=proxy action=blocked
| bin _time span=1d
| stats count(http_url) as http_url_count by _time
| eval http_url_count=http_url_count/1000
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...