Splunk Search

How to create a stacked bar chart to compare denied and permitted traffic for the top 30 denied IP addresses from firewall logs?

simon_lavigne
Path Finder

I have firewall logs where I'd like to count the top 30 denied IP addresses and from that, create a stacked bar chart comparing denied and permitted traffic for those IP addresses

Should I create two searches? One to search for the top 30 denied IP addresses, write results to a lookup table and then, a second search to use the lookup and count permitted and denied traffic to build the chart?

Or can I get the same result using a subsearch?

0 Karma
1 Solution

simon_lavigne
Path Finder

I've ended up creating eventtypes to identify permitted and denied firewall traffic and then scheduled two reports. The first report searches for the top 30 IP's with denied traffic and uses an outputlookup to save to CSV.

eventtype="firewall_deny" src_network=internet | top limit=30 src | outputlookup top_30_ip_deny.csv

The second report uses an inputlookup to generate the stacked bar chart.

eventtype="firewall" [| inputlookup top_30_ip_deny.csv | fields + src] | chart count over src by action

View solution in original post

0 Karma

simon_lavigne
Path Finder

I've ended up creating eventtypes to identify permitted and denied firewall traffic and then scheduled two reports. The first report searches for the top 30 IP's with denied traffic and uses an outputlookup to save to CSV.

eventtype="firewall_deny" src_network=internet | top limit=30 src | outputlookup top_30_ip_deny.csv

The second report uses an inputlookup to generate the stacked bar chart.

eventtype="firewall" [| inputlookup top_30_ip_deny.csv | fields + src] | chart count over src by action

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...