Splunk Search

Need help merging 2 stats outputs to one chart to get a total bytes count over time per source and destination

fonteca
New Member

Here is what the code looks like separate,

(my search) | stats sum(bytes) by src_ip | sort 5 -bytes

and

(my search) | stats sum(bytes) by dst_ip | sort 5 -bytes

I basically want to merge both of these outputs onto one graph so I don't have two separate graphs, (for space sake)

I have tried a combination of filters, append, appendcol, streamstats and I have had no luck yet.

Thanks for any/all help

0 Karma

somesoni2
Revered Legend

Just in case you're still interested in that panel, try this

(your base search) | eval IPAddr=src_ip." ".dst_ip | makemv IPAddr | stats sum(bytes) as Bytes by IPAddr

fdi01
Motivator

(my search) | stats sum(bytes) as sum_bytes_src_ip by src_ip | sort 5 -bytes
| appendcols [search (my search) | stats sum(bytes) as sum_bytes_dst_ip by dst_ip | sort 5 -bytes ]
|table sum_bytes_src_ip src_ip sum_bytes_dst_ip dst_ip

or

(my search) | streamstats sum(bytes) as sum_bytes_src_ip by src_ip| appendcols [search (my search)
| streamstats sum(bytes) as sum_bytes_dst_ip by dst_ip]
|table sum_bytes_src_ip src_ip sum_bytes_dst_ip dst_ip

0 Karma

Raghav2384
Motivator
(my search) |stats sum(bytes) as Bytes by src_ip,dst_ip 

Thanks,
Raghav

0 Karma

fonteca
New Member

Thanks for your help, fdi01 and Raghav2384. I have attempted both of your solutions and couldn't reach the desired outcome I was looking for. So thusly I have decided to scrap this panel in favor of a different one. I would like to thank you both for your help though, it was much appreciated.

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...