Splunk Search

How Do I Make 5 Bar Graphs by Using the Output of a Chart String as Input to a Timechart String?

jeremy_fade
New Member

I use the following search to show a pie chart of the top 5 IPs connecting to the network:

sourcetype="conn_log" | chart count by Orig_IP | sort -count | head 5

I also use the following search to look up a specific IP (for example, 8.8.8.8) on all logs, exclude instances where the IP doesn't exist, then view it on a bar graph:

8.8.8.8 | timechart span=1h count by sourcetype | addtotals | search Total > 0

Ideally, I want to combine these 2 strings to have the first string fill in the IP criteria for the second string, making a bar graph for each of the top 5 IPs. But if this can't be done, is there a way to make 5 individual search strings to display bar graphs for each of the top 5 IPs?

0 Karma

woodcock
Esteemed Legend

Maybe (not sure about how you are doing sourcetype) like this:

index=YouShouldAlwaysSpecifyAnIndex sourcetype="conn_log" 
[search index=YouShouldAlwaysSpecifyAnIndex sourcetype="conn_log" | Top 5 Orig_IP | table Orig_IP]
| timechart span=1h count BY sourcetype

Also, look at the new Trellis feature:
https://discoveredintelligence.ca/splunk-6-6-new-features-part-iv-trellis/

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Best to always code the index.

index=foo sourcetype="conn_log" 
     [ search index=foo sourcetype="conn_log" 
     | chart count by Orig_IP 
     | sort 5 -count 
     | table Orig_IP
     ]
| timechart span=1h count by Orig_IP
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...