How to create a stacked bar chart to compare denied and permitted traffic for the top 30 denied IP addresses from firewall logs?

[simon_lavigne]

I have firewall logs where I'd like to count the top 30 denied IP addresses and from that, create a stacked bar chart comparing denied and permitted traffic for those IP addresses

Should I create two searches? One to search for the top 30 denied IP addresses, write results to a lookup table and then, a second search to use the lookup and count permitted and denied traffic to build the chart?

Or can I get the same result using a subsearch?

[simon_lavigne · Accepted solution]

I've ended up creating eventtypes to identify permitted and denied firewall traffic and then scheduled two reports. The first report searches for the top 30 IP's with denied traffic and uses an outputlookup to save to CSV.

eventtype="firewall_deny" src_network=internet | top limit=30 src | outputlookup top_30_ip_deny.csv

The second report uses an inputlookup to generate the stacked bar chart.

eventtype="firewall" [| inputlookup top_30_ip_deny.csv | fields + src] | chart count over src by action