I have the following search
index="pan" (dest_ip="192.168.*" AND NOT src_ip="192.168.*" AND NOT src_location="AU" AND NOT src_location="*-*" )
| chart count by src_location,action
This results in a nice stacked column chart showing actions (allowed & blocked) per src_location.
What I need to do is only show those src_locations where the total count (allowed + blocked) is greater than a specific value (eg totalCount >= 500).
I have tried using separate stats count by [field] as [name] statements then using eval to add them together but I can't get the results I'm wanting which is the stacked column graph by src_location showing allowed & blocked.
Any suggestions greatly appreciated.
@balcv ,
Try
index="pan" (dest_ip="192.168.*" AND NOT src_ip="192.168.*" AND NOT src_location="AU" AND NOT src_location="*-*" )
| chart count by src_location,action
| addtotals row=true fieldname=totalCount | where totalCount >= 500|fields - totalCount
@balcv ,
Try
index="pan" (dest_ip="192.168.*" AND NOT src_ip="192.168.*" AND NOT src_location="AU" AND NOT src_location="*-*" )
| chart count by src_location,action
| addtotals row=true fieldname=totalCount | where totalCount >= 500|fields - totalCount
Awesome. Thanks for that @renjith.nair