How can I add the "act*" and "target*" fields to this table with "Host" being the primary field?

[Earenhart]

Hello everyone,

This search is designed to alert on potential password spraying attempts on servers in my environment. I have this search working when I leave out "| appendpipe [table act* target*]", but I am trying to figure out how to add those fields to the results while keeping my created "Server" field intact. Any ideas are greatly appreciated.

index=wineventlog sourcetype=WinEventLog:Security EventCode=4625 
| eval event=_raw
| rex mode=sed field=event "s/[\n\r]//g"
| rex field=event "Subject:.*Security ID:\t*(?.*?)\tAccount Name:(?.*?)\t*Account Domain:\t*(?.*?)Logon ID:\t*(?.*?)Logon Type"
| rex field=event "Account For Which Logon Failed:\tSecurity ID:\t*(?.*?)\tAccount Name:(?.*?)\t*Account Domain:\t*(?.*?)Failure Information" 
| bin _time span=1m 
| stats dc(user) as EvtCounts by src 
| rename src as server
| where EvtCounts >50
| eval Server = server." (".EvtCounts.")"
| table Server
| appendpipe [table act* target*]

[richgalloway · Accepted solution]

The only fields available at the end of your query are 'server' and 'EvtCounts. That's because thestatscommand filters out all fields except those explicitly mentioned. You should be able to avoid that by usingstreamstats`. Like this:

| streamstats dc(user) as EvtCounts by src 
| rename src as server
| where EvtCounts >50
| eval Server = server." (".EvtCounts.")"
| table Server act target*

[Earenhart]

Thank you very much Rich! Using streamstats did the trick.