https://community.splunk.com/t5/Splunk-Search/IF-with-some-conditionals/m-p/311989#M93462 <P>My mistake it was that i forgotten the "" with "LOGIN".<BR /> Please cancel my question.</P> Mon, 26 Feb 2018 00:00:34 GMT jnahuelperez35 2018-02-26T00:00:34Z https://community.splunk.com/t5/Splunk-Search/IF-with-some-conditionals/m-p/311988#M93461 <P>I guys! i would like to count the fail and success logons on my SFTP. The events are<BR /> Successfull Logins from different accounts:<BR /> [40] Sat 24Feb18 01:53:49 - (1809219) HTTP_LOGIN: user: MYUSER; domain: cname.mydomain.com<BR /> [31] Sun 25Feb18 20:05:03 - (1836845) SSH2_MSG_USERAUTH_SUCCESS: successful login</P> <P>Failed logins from different accounts:<BR /> [31] Sun 25Feb18 20:05:03 - (1836845) SSH2_MSG_USERAUTH_FAILURE: login failed<BR /> [41] Sat 24Feb18 01:53:38 - (1809216) HTTP_OKAY (200): SESS_FAIL</P> <P>So i made this search:</P> <PRE><CODE> index="sftp" SSHCommand="MSG_USERAUTH_SUCCESS" OR http_command=LOGIN OR SSHCommand="MSG_USERAUTH_FAILURE" OR Event_Message="*SESS_FAIL*" Event_Message="HTTP_OKAY (200): SESS_FAIL" | eval type=IF(SSHCommand="MSG_USERAUTH_SUCCESS" OR (Event_Message="HTTP_LOGIN: user:*"),"SUCCESS", IF(SSHCommand="MSG_USERAUTH_FAILURE" OR Event_Message="HTTP_OKAY (200): SESS_FAIL","FAIL","OTHER")) | stats list(Event_Message) by type </CODE></PRE> <P>But it returns "other" values that star with:<BR /> HTTP_LOGIN: user: MYUSER; domain: cname.mydomain.com</P> <P>any ideas?</P> Tue, 29 Sep 2020 18:11:46 GMT https://community.splunk.com/t5/Splunk-Search/IF-with-some-conditionals/m-p/311988#M93461 jnahuelperez35 2020-09-29T18:11:46Z https://community.splunk.com/t5/Splunk-Search/IF-with-some-conditionals/m-p/311989#M93462 <P>My mistake it was that i forgotten the "" with "LOGIN".<BR /> Please cancel my question.</P> Mon, 26 Feb 2018 00:00:34 GMT https://community.splunk.com/t5/Splunk-Search/IF-with-some-conditionals/m-p/311989#M93462 jnahuelperez35 2018-02-26T00:00:34Z