I am trying to get total traffic vs attack traffic splunk query in order to keep it in dashboard panel.
We have a field called attack_type which contains all the attacks and those will be dynamic (daily new ones will be coming).
For last 24 hours, we have 1000 total events and 400 attack_type events.
how can I show this in single dashboard panel:
tried to write this query:
index=* *jupiter* | stats count as "Total Traffic" count(eval(attack_type="*")) as "Attack Traffic"
but getting this error:
Error in 'stats' command: The eval expression for dynamic field 'attack_type=*' is invalid. Error='The expression is malformed. An unexpected character is reached at '*'.'.
please help me in this regards.
You probably wanted to do something like
stats count(eval(isnotnull(attack_type)))
I must say though that I don't like the stats eval syntax - it can be confusing. I prefer to do stuff explicitly. Like this:
| eval isattack=if(isnotnull(attack_type),1,0)
| stats sum(attack_type)
PS: Oh, and don't search across all your indexes. While it might work relatively not that bad on some small deployments or for a user with very limited permissions, it's a very bad habit which doesn't scale well. And don't use wildcards at the beginning of your search term (like *juniper*).
Wildcards don't work everywhere and the eval function may be one of those places. Try using isnotnull(), instead.
index=* *jupiter*
| stats count as "Total Traffic" count(eval(isnotnull(attack_type))) as "Attack Traffic"
On the subject of wildcards, avoid using index=*, except in special circumstances. Also, a leading wildcard in the search command (as in "*jupiter*") is very inefficient.