Simple Bubble Chart

[rbw78]

Hello.

I'm a newbie on splunk and i need some help for a Bubble Chart.

I want to count the total of matchs between sources and destinations hosts from my logs.
here is a log exemple :

Dec 15 17:22:27 10.233.86.237 Dec 15 17:22:19 LW5YOPDSY dsa_mpf: REASON=Invalid_Ack act=Deny IN=Local_Area_Connection OUT= MAC=F0:DE:F1:34:04:87:00:21:55:EF:8C:7F:08:00 SRC=213.181.36.229 DST=10.233.86.237 LEN=60 DF FRAG=0 PROTO=TCP SPT=16384 DPT=65308 RES=0x00 ACK CNT=1

SRC for source and DST for destination.

I tried to do some xml in my dashboard but i event don't what kind of search i have to do on my logs.

<row>
   <chart>
    <searchName>TestBubbleChart</searchName>
    <title>TestBubbleChart</title>
        <option name="charting.chart">bubble</option>
        <option name="charting.axisX.categories">SRC</option> # Sources on X axe
        <option name="charting.axisY.categories">DST</option> # Destinations on Y axe
        <option name="charting.axisLabelsZ">numeric</option>  # Count the matchs on Z axe 
   </chart>
  </row>

thanks for your help.

[MarioM]

could you explain a bit more what you mean by "count the total of matchs between sources and destinations"? what is your search command ie:"| stats dc(SRC) dc(DST)" ?

[rbw78]

Still no one could help on this topic ?

😞

[rbw78]

Well my xml file look like this :

<row>
   <chart>
    <searchName>TestBubbleChart</searchName>
    <title>TestBubbleChart</title>
        <option name="charting.chart">bubble</option>
        <option name="charting.axisX">SRC</option>
        <option name="charting.axisY">DST</option>
        <option name="charting.axisZ">numeric</option>
        <option name="charting.axisZ.minimumNumber">0</option>
        <option name="charting.axisZ.maximumNumber">1000</option>
   </chart>
  </row>

I did the following search on my logs but still no result

eventtype="EVENT_DSA" | rex "(?i) .*?=(?P<SRC>\d+\.\d+\.\d+\.\d+)(?= )" | rex "(?i) dst=(?P<DST>[^ ]+)"

[rbw78]

Anyone know how to do that ?