Splunk Search

Charting the 2 fields on the same chart.

justinfranks
Path Finder

I have a log of login timestamps. I would like to display the total count and total unique value count on the same bar chart.

Here is my search:

sourcetype="etv" cname="*" ur="*" | stats dc(u) as "unique", count by u | chart sum(count) as "Total Logins", sum(unique) as "Total Unique Logins"

Where 'u' is the UserID.

However, this search charts the "Total Logins" by "Total Unique Logins", which is not what I want.

alt text

Is there a way chart this information, split by their field names?

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

Would this work

sourcetype="etv" cname="*" ur="*" 
| stats dc(u) as "Total Unique Logins" count as "Total Logins"
| transpose

And then choose the Visualization tab

(After some thought, I figured out that you can simplify your calculations.)

View solution in original post

lguinn2
Legend

Would this work

sourcetype="etv" cname="*" ur="*" 
| stats dc(u) as "Total Unique Logins" count as "Total Logins"
| transpose

And then choose the Visualization tab

(After some thought, I figured out that you can simplify your calculations.)

justinfranks
Path Finder

Thanks! The transpose command was what I was missing.

0 Karma

lguinn2
Legend
sourcetype="etv" cname="*" ur="*" 
| stats dc(u) as "unique", count by u 
| stats sum(count) as "Total Logins", sum(unique) as "Total Unique Logins"

should work

justinfranks
Path Finder

I thought so too but here is what I get:

http://i.imgur.com/UR0dLKB.png

However, I'd like to have them on different bars of the count on the bottom.

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

Incidentally... Depending on the difference between total logins and unique logins, you may need to set the y-axis to "log" rather than "linear" in order to see the relationship between them.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...