Splunk Search

How to chart the number of occurrences including its respective threshold for each host and each eventtype?

zapping575
Explorer

Hi everybody,

I have the following problem and cannot seem to be able to wrap my head around it:

  1. I have a bunch of eventtypes (close to 1000).
  2. Some of those eventtypes have certain thresholds which are greater than zero. I look the values up from a csv
  3. For a single host, I'd like to
    1. Chart the number of occurrances for an eventtype IF
      1. That number of occurrances is higher than the aforementioned threshold
      2. The chart shall also contain a static line depicting the threshold value

Here is what I have so far. I believe I am always getting lost when using an aggregate function such as count() because added something to the result using eval just wont work.

 

 

index="my_index" eventtype=* host="$HOST_FROM_DROPDOWN$"  
| lookup my-events eventtype 
| eventstats count by eventtype 
| where alert_threshold > 0 AND count > alert_threshold
| stats count by eventtype 
| eval Threshold = alert_threshold

 

 What I do understand is that I have to add the "Threshold" variable in the overlay Options of the chart.

Any help is much appreciated. Thank you

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats count values(alert_threshold) as alert_threshold by eventtype 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| stats count values(alert_threshold) as alert_threshold by eventtype 

zapping575
Explorer

Thank you very much. I got it working as expected like this:

index="my_index" eventtype=* host="dropdown_value..."  
| lookup my_lookup eventtype 
| stats count values(alert_threshold) as alert_threshold by eventtype 
| where alert_threshold > 0 AND count > alert_threshold
| sort count desc

 

Now the only thing left is that the threshold value is drawn as a dot in the chart. I'd like it to be a line going across the entire bar. Is that possible?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You will get a dot if there is only 1 point on the line e.g. only one event type breaches the threshold

0 Karma

zapping575
Explorer

Acknowledged. thanks

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...