I am investigating failed logins. I need to perform a count of all failed logins by user, take an average of that count, and then only show results that are higher than the average.
index=windows fail*
| stats earliest(_time) as "Earliest Failure", latest(_time) as "Latest Failure", count by user
| *Need to Average the count here*
| convert ctime("Earliest Failure") ctime("Latest Failure")
| where count > *Average*
| table user "Earliest Failure" "Latest Failure" count
| sort -count
Thanks in advance!
try just adding an eventstats
index=windows fail*
| stats earliest(_time) as "Earliest Failure", latest(_time) as "Latest Failure", count by user
| eventstats avg(count) as "Average"
| convert ctime("Earliest Failure") ctime("Latest Failure")
| where count > Average
| table user "Earliest Failure" "Latest Failure" count
| sort -count
try just adding an eventstats
index=windows fail*
| stats earliest(_time) as "Earliest Failure", latest(_time) as "Latest Failure", count by user
| eventstats avg(count) as "Average"
| convert ctime("Earliest Failure") ctime("Latest Failure")
| where count > Average
| table user "Earliest Failure" "Latest Failure" count
| sort -count
Perfect! Thank you!