I am looking for logon errors from both windows and nix systems and trying to get as much data to match up as proposal
Here is my win search:
index=main or index=os action=failure 'logins' | top host, user, EventCodeDescription limit="10000" | sort -count | fields count, host, user, EventCodeDescription, EventCode, percent
this works fine because win has all the fields in the output. nix does not. the nix events are identified by the 'logins' macro but they do not have the right fileds so they do not show in the results table.
I have tried this to add the field "EventCodeDescription" when nul:
index=main OR index=os action=failure
logins| eval EventCodeDescription=if(EventCodeDescription==" ", "nix failed logon", EventCodeDescription) | top host, user, EventCodeDescription limit="10000" | sort -count | fields count, host, user, EventCodeDescription, EventCode, percent
But the field is not added.
How can I add a field and a VALUE to the nix events where there is no field so that they show up with the win events?
fillnull value=NULL
Thanks that really helps. that was the answer
It does not have to be null.
|fillnull value="failed logon" EventCodeDescription |
You don't need the if statement.
wont this set the win value for "EventCodeDescription" to null?
If i do this
|fillnull value=null EventCodeDescription | eval EventCodeDescription=if(EventCodeDescription=null,"failed logon",)
I still get "EventCodeDescription=null"