Im trying to break out the comma separated values in my results but im brain farting. I want to break out the specific reasons - {New Geo-Location=NEGATIVE, New Device=POSITIVE, New IP=NEGATIVE, New State=NEGATIVE, New Country=NEGATIVE, Velocity=NEGATIVE, New City=NEGATIVE}
index="okta" actor.alternateId="*mydomain*" outcome.reason=*CHALLENGE* client.geographicalContext.country!="" actor.displayName!="Okta System" AND NOT "okta_svc_acct"
| bin _time span=45d
| stats count by outcome.reason, debugContext.debugData.behaviors
| sort -count
outcome.reason | debugContext.debugData.behaviors |
Sign-on policy evaluation resulted in CHALLENGE | {New Geo-Location=NEGATIVE, New Device=POSITIVE, New IP=NEGATIVE, New State=NEGATIVE, New Country=NEGATIVE, Velocity=NEGATIVE, New City=NEGATIVE} |
Sign-on policy evaluation resulted in CHALLENGE | {New Geo-Location=NEGATIVE, New Device=NEGATIVE, New IP=NEGATIVE, New State=NEGATIVE, New Country=NEGATIVE, Velocity=NEGATIVE, New City=NEGATIVE} |
Sign-on policy evaluation resulted in CHALLENGE | {New Geo-Location=NEGATIVE, New Device=POSITIVE, New IP=POSITIVE, New State=NEGATIVE, New Country=NEGATIVE, Velocity=NEGATIVE, New City=NEGATIVE} |
Sign-on policy evaluation resulted in CHALLENGE | {New Geo-Location=POSITIVE, New Device=POSITIVE, New IP=POSITIVE, New State=NEGATIVE, New Country=NEGATIVE, Velocity=NEGATIVE, New City=POSITIVE} |
Sign-on policy evaluation resulted in CHALLENGE | {New Geo-Location=NEGATIVE, New Device=NEGATIVE, New IP=POSITIVE, New State=NEGATIVE, New Country=NEGATIVE, Velocity=NEGATIVE, New City=NEGATIVE} |
The split function can break up the field for you.
index="okta" actor.alternateId="*mydomain*" outcome.reason=*CHALLENGE* client.geographicalContext.country!="" actor.displayName!="Okta System" AND NOT "okta_svc_acct"
``` The trim function removes the braces from the ends of the field ```
| eval behaviors=split(trim('debugContext.debugData.behaviors', "{}"),",")
| mvexpand behaviors
| bin _time span=45d
| stats count by outcome.reason, behaviors
| sort -count
That worked! thanks!
The split function can break up the field for you.
index="okta" actor.alternateId="*mydomain*" outcome.reason=*CHALLENGE* client.geographicalContext.country!="" actor.displayName!="Okta System" AND NOT "okta_svc_acct"
``` The trim function removes the braces from the ends of the field ```
| eval behaviors=split(trim('debugContext.debugData.behaviors', "{}"),",")
| mvexpand behaviors
| bin _time span=45d
| stats count by outcome.reason, behaviors
| sort -count