Splunk Search

using bar charts

moayadalghamdi
Path Finder

Hello splunkers

 

 

i want to create a visualization for my command to create a bar chart that contains the (src_ip/user) information on the x-axis and the count on the y-access

 

i tried this command but it  aint working:

index=MyApp  eventtype=My_App_Authentication_logs user=* action=failure | top 10 user by src | sort -count | where count>=4 | head 20| table src user count

i need your help please

 

 

Thanks in advance

 

 

Labels (3)
0 Karma
1 Solution

admin12345678
Path Finder

use this in the end of your query

 

|eval "src.user"=src." :: ".user |fields src.user count

 

 

View solution in original post

admin12345678
Path Finder

use this in the end of your query

 

|eval "src.user"=src." :: ".user |fields src.user count

 

 

View solution in original post

moayadalghamdi
Path Finder

thanks a lot my splunker mate ^_^

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please elaborate on "it ain't working".  What results do you get and how do they compare to the expected results?

---
If this reply helps you, an upvote would be appreciated.

moayadalghamdi
Path Finder

Thanks for the reponse rich ^_^ 

 

take a look at this statistics:

Splunk question statics.PNG

 

 

 

 

 

 

 

 

now i want to show this table as a bar chart where the combination of (SRC/User)  is on the x-axis and the count is on the Y-axis, like:

Splunk question barchart.PNG

the y-axis only shows the SRC field, i want to combine it with the user field

0 Karma