topic Re: Multiple raw text fields returned and charted in Splunk Search

Multiple raw text fields returned and charted

MattQ — Thu, 11 Apr 2013 14:14:14 GMT

There have been many answers close to my solution but I have not been able to replicate based on those.

I am looking at pulling 3 sets of data from login logs.

1. Logins
2. Login Success
3. Login Failure

and then chart them over time: 60 minutes or 24 hours.

What I want to be able to see is a trend over time showing ALL login attempts (be them success or fail) and then also graph lines underneath that (which would add up to the top line of course) of all Success and all Failure.

The text in my log returns as simple |LOGIN SUCCESS| or |LOGIN FAILURE|

Thanks!

Re: Multiple raw text fields returned and charted

jonuwz — Thu, 11 Apr 2013 14:45:40 GMT

... | rex "\|LOGIN (?<authen>\w+)\|" | timechart span=1h count by authen

Then change the chart visualisation to bar chart - stacked

No need for 2 seperate graphs, a single stacked chart will show you all the data you need

Re: Multiple raw text fields returned and charted

MattQ — Thu, 11 Apr 2013 14:50:56 GMT

This does give me a graph of all the login activity. I am actually wanting the separated data of Failure and Success as well though. To look for trends vs just an increase in activity. e.g. We see a high amount of login attempts overall, I would like the graph to have the two sub lines of success and failure to determine if an inordinate amount of that traffic is 'Failure'.

Thank you for your answer and any follow up. Really trying to get my brain around which way to think about these things.

Re: Multiple raw text fields returned and charted

yannK — Thu, 11 Apr 2013 15:42:43 GMT

A small trick, I always use to distinguish oposite lines.
use an eval function to put one of the trend in negative, that way the graph will show under the X axis.

... | rex "\|LOGIN (?<authen>\w+)\|" | timechart span=1h count by authen | eval count=if(authen="FAILURE",-count,count)