I have tired the following commands to retrieve the results, but it fails.
|from datamodel:"Authentication"."Failed _Authentication" | stats values(user) count by (action=failure), src | sort -count
or
|from datamodel:"Authentication"."Failed _Authentication" | stats values(user) values(src) count by (action=failure) | sort -count
And I want to achieve the following results.
+-------+--------+-------+
| User | src | count |
+-------+--------+-------+
| Mary | IT1001 | 10 |
+-------+--------+-------+
| Mary | IT1002 | 6 |
+-------+--------+-------+
| Peter | IT2002 | 9 |
+-------+--------+-------+
| Alan | IT3003 | 8 |
+-------+--------+-------+
Please help me. Thanks.
|from datamodel:"Authentication"."Failed _Authentication" | where Authentication.action="failure" | stats values(src), count by user | sort -count
@hyleung,
|from datamodel:"Authentication"."Failed _Authentication"|stats count by user,src