Splunk Search

How to create stacked bar chart for http/https?

jrich523
Path Finder

is it possible to do a stacked bar chart where it splits it in two to show how much is https requests and how much is http requests?

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You must make sure you have an extraction on your data to differentiate the two, but you would simply do:

sourcetype=whatever | chart count by ssl_type

where ssl_type might be the field that contains, say, the inbound port number or a search-time extraction of the incoming URL request, assuming that is logged.

View solution in original post

BunnyHop
Contributor

Try this search:

sourcetype=whatever | chart count(ssl_type) over protocol by ssl_type

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You must make sure you have an extraction on your data to differentiate the two, but you would simply do:

sourcetype=whatever | chart count by ssl_type

where ssl_type might be the field that contains, say, the inbound port number or a search-time extraction of the incoming URL request, assuming that is logged.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...