Splunk Search

Simple Bubble Chart

rbw78
Communicator

Hello.

I'm a newbie on splunk and i need some help for a Bubble Chart.

I want to count the total of matchs between sources and destinations hosts from my logs.
here is a log exemple :

Dec 15 17:22:27 10.233.86.237 Dec 15 17:22:19 LW5YOPDSY dsa_mpf: REASON=Invalid_Ack act=Deny IN=Local_Area_Connection OUT= MAC=F0:DE:F1:34:04:87:00:21:55:EF:8C:7F:08:00 SRC=213.181.36.229 DST=10.233.86.237 LEN=60 DF FRAG=0 PROTO=TCP SPT=16384 DPT=65308 RES=0x00 ACK CNT=1

SRC for source and DST for destination.

I tried to do some xml in my dashboard but i event don't what kind of search i have to do on my logs.

<row>
   <chart>
    <searchName>TestBubbleChart</searchName>
    <title>TestBubbleChart</title>
        <option name="charting.chart">bubble</option>
        <option name="charting.axisX.categories">SRC</option> # Sources on X axe
        <option name="charting.axisY.categories">DST</option> # Destinations on Y axe
        <option name="charting.axisLabelsZ">numeric</option>  # Count the matchs on Z axe 
   </chart>
  </row>

thanks for your help.

Tags (3)

MarioM
Motivator

could you explain a bit more what you mean by "count the total of matchs between sources and destinations"? what is your search command ie:"| stats dc(SRC) dc(DST)" ?

rbw78
Communicator

Still no one could help on this topic ?

😞

0 Karma

rbw78
Communicator

Well my xml file look like this :

<row>
   <chart>
    <searchName>TestBubbleChart</searchName>
    <title>TestBubbleChart</title>
        <option name="charting.chart">bubble</option>
        <option name="charting.axisX">SRC</option>
        <option name="charting.axisY">DST</option>
        <option name="charting.axisZ">numeric</option>
        <option name="charting.axisZ.minimumNumber">0</option>
        <option name="charting.axisZ.maximumNumber">1000</option>
   </chart>
  </row>

I did the following search on my logs but still no result

eventtype="EVENT_DSA" | rex "(?i) .*?=(?P<SRC>\d+\.\d+\.\d+\.\d+)(?= )" | rex "(?i) dst=(?P<DST>[^ ]+)"
0 Karma

rbw78
Communicator

Anyone know how to do that ?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...