Create a new variable for each color of bar that you want: redCount, yellowCount, greenCount - for example Assign the count value to the appropriate variable Create a stacked column chart (or a stacked bar chart if you want it horizontally) Put the chart in a dashboard, so that you can set the color attributes for the bars Here is a simple XML example of the code snippet for a chart that should work: <searchString>sourcetype=mysourcetype AND searchstuffforerrors | stats count by host | eval redCount = if(count>20,count,0) | eval yellowCount = if(count<=20 AND count>15,count,0) | eval greenCount = if(count<=15, count, 0) | fields - count</searchString> <title>Server Errors by Host - Last 24 hours</title> <earliestTime>-24h@h</earliestTime> <latestTime>@h</latestTime> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.fieldColors">{"redCount":0xFF0000,"yellowCount":0xFFFF00, "greenCount":0x73A550}</option> <option name="charting.legend.placement">none</option> <option name="charting.legend.placement">none</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">90</option> </chart> Note that the last option sets the X-axis labels to print vertically on the column chart. If you prefer, you could set the charting.chart option to "bar" and then eliminate the option for charting.axisLabelsX.majorLabelStyle.rotation ... View more

"Generate summary statistics of all existing fields in your search results and save them as values in new fields. Eventstats is similar to the stats command, except that aggregation results are added inline to each event and only if the aggregation is pertinent to that event." In the limits.conf file, the max_mem_usage_mb parameter is used to limit how much memory the stats and eventstats commands use to keep track of information. If the eventstats command reaches this limit, the command stops adding the requested fields to the search results. You can increase the limit, contingent on the available system memory. Also, here are the link to the documentation files for stats and evenstats respectively: http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Stats http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Eventstats ... View more

You would have to use some DNSlookup type of things to get IP address from host name. And you can use clientip, src_ip, dns_ip, server_ip..Etc according to your Splunk naming conversion you have to use the search strings. See the props.conf file for host and ip Try to use this query, index=_audit action="login attempt" info="succeeded"| head 20 | iplocation clientip | table clientip, user, _time ... View more