Hi,
I am trying to do a timechart which shows the amount of sessions opened/closed.
Where the Opened and Closed are 2 separate lines.
The Current search I have looks as follows:
index="main" ("session" ("closed" OR "opened") AND NOT "cron:session")
| timechart
count(eval("session opened")) AS Opened,
count(eval("session closed")) AS Closed
Now the problem I am having is that they both show as the same 'count' amount.
When I separate this timechart into 2 different charts it works fine.
The log looks as follows:
Oct 19 09:06:10 YYY sshd[16997]: pam_unix(sshd:session): session opened for user XXX by (uid=0)
Oct 19 09:02:07 YYY sshd[13684]: pam_unix(sshd:session): session closed for user XXX
Oct 19 08:57:13 YYY sshd[13684]: pam_unix(sshd:session): session opened for user XXX by (uid=0)
Oct 19 00:26:43 YYY sshd[8577]: pam_unix(sshd:session): session opened for user XXX by (uid=0)
Daniel
You first need to create a filed for open/closed using the field extractor workflow or by defining a regex. eval in count is generally used along the lines of
... | timechart count(eval(field="value"))
The way you have crafted your eval without a field is basically causing the search to perform an arbitrary evaluation that roughly evaluates to
... | timechart count(TRUE)
which I think is just counting everything
You first need to create a filed for open/closed using the field extractor workflow or by defining a regex. eval in count is generally used along the lines of
... | timechart count(eval(field="value"))
The way you have crafted your eval without a field is basically causing the search to perform an arbitrary evaluation that roughly evaluates to
... | timechart count(TRUE)
which I think is just counting everything
thank you for the clarification on requiring a field extractor, i downloaded the 'Field Extractor' App which helped create the new field called session
which can either be "opened", "closed", "failure;" or "pass;"
(it picked up a few fields from authentication as well but that is alright xD)
Current search which is working
index="main" ("session" AND NOT "cron:session")
| timechart
count(eval(session="opened")) AS Opened,
count(eval(session="closed")) AS Closed