Splunk Search

How to create stacked bar chart for http/https?

jrich523
Path Finder

is it possible to do a stacked bar chart where it splits it in two to show how much is https requests and how much is http requests?

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You must make sure you have an extraction on your data to differentiate the two, but you would simply do:

sourcetype=whatever | chart count by ssl_type

where ssl_type might be the field that contains, say, the inbound port number or a search-time extraction of the incoming URL request, assuming that is logged.

View solution in original post

BunnyHop
Contributor

Try this search:

sourcetype=whatever | chart count(ssl_type) over protocol by ssl_type

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You must make sure you have an extraction on your data to differentiate the two, but you would simply do:

sourcetype=whatever | chart count by ssl_type

where ssl_type might be the field that contains, say, the inbound port number or a search-time extraction of the incoming URL request, assuming that is logged.

Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...