I am working on eval expression. I have a set of data and I want to evaluate a field such that I only extract login authentication messages.
The following search string helps to extract only logins:
| eval logins=if(like(message,"Login%"),"is_login","is_not_login")
is_login :84 events (failed and successful login events)
is_not_login: 551 events (all other events)
I would like to create a second eval expression where I zoom in on "is_login" field and further split the values into two.
|eval action=if(like(is_login,"Login failed%"),"Failure","Success")
No Failure value in 'action' field.
Success: 635 events (whole log file events)
I expect to get a field 'action' with two values within it, Failure and Success. However I only get one Success value which represents all events from the log file itself.
Combined eval search:
| eval logins=if(like(message,"Login%"),"is_login","is_not_login") |eval action=if(like(is_login,"Login failed%"),"Failure","Success")
I need help to see if my logic is correct, the first eval seperates login events from all other events, the second eval further divides the failed and successful login events.
... View more