Splunk Search

How to use chart command to show results for only days with values?

mchristian
Loves-to-Learn

So I'm trying to chart blocked traffic(IPs) over 7 days... the purpose to help locate beaconing traffic (this has worked at a previous job but im taking it a step further by only wanting to see days with values.... example:

mchristian_0-1645546811822.png

I would want to see results that only show, All days with values... Query works just see alot of days with 0 data

Here's my query:

index="pan_logs" sourcetype="pan:traffic" dest_zone="Public" src="10.11.16*" action=blocked
| chart count(dest) by dest date_wday

Labels (1)
0 Karma

somesoni2
Revered Legend

Give this a try

index="pan_logs" sourcetype="pan:traffic" dest_zone="Public" src="10.11.16*" action=blocked
| chart count(dest) by dest date_wday
| eval do_not_show=0
| foreach M* T* W* F* S* [| eval do_not_show= do_not_show+if('<<FIELD>>'==0,1,0)] | where do_not_show=0 | fields - do_not_show
0 Karma

mchristian
Loves-to-Learn

Im still receiving 0 under days

mchristian_0-1645544742715.png

 

0 Karma

somesoni2
Revered Legend

Try this (accounting for case difference for field name)

index="pan_logs" sourcetype="pan:traffic" dest_zone="Public" src="10.11.16*" action=blocked
| chart count(dest) by dest date_wday
| eval do_not_show=0
| foreach M* m* T* t* W* w*  F* f* S* s* [| eval do_not_show= do_not_show+if('<<FIELD>>'==0,1,0)] | where do_not_show=0 | fields - do_not_show
0 Karma

mchristian
Loves-to-Learn

I received the same results... I may just try a different approach, i just feel like it shouldnt be this difficult

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| untable dest date_wday count
| eventstats min(count) as minimum by dest
| where minimum>0
| xyseries dest date_wday count
0 Karma

mchristian
Loves-to-Learn

that didnt produce any results

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="Dest IP,Monday,Tuesday,Wed,Thurs,Friday
1.1.1.1,5,3,0,0,0
2.2.2.2,3,3,3,3,3"
| multikv forceheader=1
| table Dest_IP Monday Tuesday Wed Thurs Friday
| untable Dest_IP date_wday count
| eventstats min(count) as minimum by Dest_IP
| where minimum>0
| xyseries Dest_IP date_wday count
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| foreach *
  [| eval <<FIELD>>=if(<<FIELD>>=0,null(),<<FIELD>>)]
0 Karma

mchristian
Loves-to-Learn

That didnt work, pretty much gave the same results, instead of 0 its giving a blank or NULL.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is that not what you wanted?

0 Karma

mchristian
Loves-to-Learn

No i would only want to see results that have values for all days, like example 2.2.2.2

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...