Splunk Search

How to create a table to show events for the past 7 days

aaroncherian
Path Finder

I am trying to create a table something like this that will fetch the data for all the events for the past 7 days. I want this to be ran any time and it would update the dates dynamically at the top. I want it to look something like this:

Host

Sourcetype

6/1

6/2

6/3

6/4

6/5

6/6

6/7

" "

" "

Count

Count

Count

Count

Count

Count

count

 

Here is my search so far:

index=" " | bucket span=1d _time | eval dayOfDate=strftime(_time,"%Y/%m/%d")  | stats count by host, sourcetype, dayOfDate | table host sourcetype dayOfDate count | rename count as "Number of events"

 

The dates show vertically and I wanted it to show up as column headers for the last 7 days that updates dynamically whenever I run this search.

Labels (5)
0 Karma
1 Solution

to4kawa
Ultra Champion

index=" " | bucket span=1d _time | eval dayOfDate=strftime(_time,"%Y/%m/%d") | stats count by host, sourcetype, dayOfDate | table host sourcetype dayOfDate count | eval hosts=host."::".sourcetype | xyseries hosts dayOfDate count

View solution in original post

to4kawa
Ultra Champion

index=" " | bucket span=1d _time | eval dayOfDate=strftime(_time,"%Y/%m/%d") | stats count by host, sourcetype, dayOfDate | table host sourcetype dayOfDate count | eval hosts=host."::".sourcetype | xyseries hosts dayOfDate count

aaroncherian
Path Finder

Thanks for that @to4kawa !! 

But is it possible to have two different columns for hosts and sourcetype instead of just them being combined into one column with a "::" in the middle? (Exact same format as my example output)

0 Karma

to4kawa
Ultra Champion

add
| rex field=hosts "(?<host>.*?)::(?<sourcetype>.*)"
| fields - hosts
| table host sourcetype *

aaroncherian
Path Finder

EDIT: Worked perfectly! Thanks @to4kawa !!!!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti &#x1f389; —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...