Splunk Search

Simple Bubble Chart

rbw78
Communicator

Hello.

I'm a newbie on splunk and i need some help for a Bubble Chart.

I want to count the total of matchs between sources and destinations hosts from my logs.
here is a log exemple :

Dec 15 17:22:27 10.233.86.237 Dec 15 17:22:19 LW5YOPDSY dsa_mpf: REASON=Invalid_Ack act=Deny IN=Local_Area_Connection OUT= MAC=F0:DE:F1:34:04:87:00:21:55:EF:8C:7F:08:00 SRC=213.181.36.229 DST=10.233.86.237 LEN=60 DF FRAG=0 PROTO=TCP SPT=16384 DPT=65308 RES=0x00 ACK CNT=1

SRC for source and DST for destination.

I tried to do some xml in my dashboard but i event don't what kind of search i have to do on my logs.

<row>
   <chart>
    <searchName>TestBubbleChart</searchName>
    <title>TestBubbleChart</title>
        <option name="charting.chart">bubble</option>
        <option name="charting.axisX.categories">SRC</option> # Sources on X axe
        <option name="charting.axisY.categories">DST</option> # Destinations on Y axe
        <option name="charting.axisLabelsZ">numeric</option>  # Count the matchs on Z axe 
   </chart>
  </row>

thanks for your help.

Tags (3)

MarioM
Motivator

could you explain a bit more what you mean by "count the total of matchs between sources and destinations"? what is your search command ie:"| stats dc(SRC) dc(DST)" ?

rbw78
Communicator

Still no one could help on this topic ?

😞

0 Karma

rbw78
Communicator

Well my xml file look like this :

<row>
   <chart>
    <searchName>TestBubbleChart</searchName>
    <title>TestBubbleChart</title>
        <option name="charting.chart">bubble</option>
        <option name="charting.axisX">SRC</option>
        <option name="charting.axisY">DST</option>
        <option name="charting.axisZ">numeric</option>
        <option name="charting.axisZ.minimumNumber">0</option>
        <option name="charting.axisZ.maximumNumber">1000</option>
   </chart>
  </row>

I did the following search on my logs but still no result

eventtype="EVENT_DSA" | rex "(?i) .*?=(?P<SRC>\d+\.\d+\.\d+\.\d+)(?= )" | rex "(?i) dst=(?P<DST>[^ ]+)"
0 Karma

rbw78
Communicator

Anyone know how to do that ?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...