Splunk Search

Charting results from top, and doing drilldowns?

jharris1111
Engager

I have a few searches / dashboards which give me basically what I want, mostly things like "top 5 alerts" reports from a network activity log. They work great in the Search view, showing the alert types, number/count of hits, and percentage in a table.

But, when I graph that on the dashboard, it doesn't behave as I would expect. The bar chart shows the alert types as bars. I expected the legend to show the severity types/values (High/Med/Low), but instead it shows "count".

When I click on the bar for "High", the drilldown I expected was "alert=high", instead it's "count=813" -- and there is no "count" field in my logs, so that fails.

I'm sure this is a common scenario for others, can anyone point me to an example search/dash that works as expected?

Tags (2)
0 Karma

davecroto
Splunk Employee
Splunk Employee

alt textThe mouse over gives me the alert status

alt text

0 Karma

davecroto
Splunk Employee
Splunk Employee
0 Karma

jharris1111
Engager

Thanks, Dave. That is working better for me.
Initially, I was doing " | top 3 alert"

With your " | count by alert" it now works better. The drill-down now does the right thing, e.g. "alert=high".

The remaining oddity is that the chart is still a single color for all bars, and the legend has only "count". The legend is not really important, but I was trying to map the bars to their appropriate color by something like:

["high","med","low"]
[0xFF0000,0xFFFF00,0x00FF00]

0 Karma

davecroto
Splunk Employee
Splunk Employee

Does it look something like this?

|chart count by alert

davecroto
Splunk Employee
Splunk Employee

Need to see your search to what your splitting "by"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...