I use the following search to show a pie chart of the top 5 IPs connecting to the network:
sourcetype="conn_log" | chart count by Orig_IP | sort -count | head 5
I also use the following search to look up a specific IP (for example, 18.104.22.168) on all logs, exclude instances where the IP doesn't exist, then view it on a bar graph:
22.214.171.124 | timechart span=1h count by sourcetype | addtotals | search Total > 0
Ideally, I want to combine these 2 strings to have the first string fill in the IP criteria for the second string, making a bar graph for each of the top 5 IPs. But if this can't be done, is there a way to make 5 individual search strings to display bar graphs for each of the top 5 IPs?