Splunk Search

using bar charts

moayadalghamdi
Path Finder

Hello splunkers

 

 

i want to create a visualization for my command to create a bar chart that contains the (src_ip/user) information on the x-axis and the count on the y-access

 

i tried this command but it  aint working:

index=MyApp  eventtype=My_App_Authentication_logs user=* action=failure | top 10 user by src | sort -count | where count>=4 | head 20| table src user count

i need your help please

 

 

Thanks in advance

 

 

Labels (3)
0 Karma
1 Solution

admin12345678
Path Finder

use this in the end of your query

 

|eval "src.user"=src." :: ".user |fields src.user count

 

 

View solution in original post

admin12345678
Path Finder

use this in the end of your query

 

|eval "src.user"=src." :: ".user |fields src.user count

 

 

moayadalghamdi
Path Finder

thanks a lot my splunker mate ^_^

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please elaborate on "it ain't working".  What results do you get and how do they compare to the expected results?

---
If this reply helps you, Karma would be appreciated.

moayadalghamdi
Path Finder

Thanks for the reponse rich ^_^ 

 

take a look at this statistics:

Splunk question statics.PNG

 

 

 

 

 

 

 

 

now i want to show this table as a bar chart where the combination of (SRC/User)  is on the x-axis and the count is on the Y-axis, like:

Splunk question barchart.PNG

the y-axis only shows the SRC field, i want to combine it with the user field

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...