Splunk Search

combining the results into one field

mcbradford
Contributor

My results are like...

src_ip           src_geo      count
55.89.12.11      US           25

I want the result to be like...

src_ip and src geo             count
55.89.12.11 - US               25

I want this so I can create a chart that shows the src_ip associated with a country and the count.

the src_ip and src_geo - I want this to be a new field

Tags (1)

mcbradford
Contributor

I figured it out..

direction="external" sourcetype="sidewinder" action=blocked src_geo="US" OR src_geo="CA" | eval src_ip_and_src_geo=src_ip." - ".src_geo | top src_ip_and_src_geo showperc=f

Ayn
Legend

Use eval to concatenate the field values together into a new field:

<yourbasesearch> | eval src_ip_and_src_geo=src_ip." - ".src_geo | stats count by src_ip_and_src_geo

mcbradford
Contributor

When I did this - my count was 1 for each, so I made a few changes..

direction="external" sourcetype="sidewinder" action=blocked src_geo="US" OR src_geo="CA" | top src_ip, src_geo showperc=f | eval src_ip_and_src_geo=src_ip." - ".src_geo | fields - src_ip fields - src_geo

This looks like I want it to, but it will not chart?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...