Why does the table not display the redirect_uri?

[jhilton90]

Can anyone tell me why my table doesn't display the redirect_uri?

index=keycloak customerReferenceAccountId!=SERVICE* username!=test*@test.co.uk type=LOGIN*
| stats count(eval(type="LOGIN")) as successful_login count(eval(type="LOGIN_ERROR")) as login_error by username, ipAddress
| eval percentage_failure=((successful_login/login_error)*100)
| eval percentage_failure=round('percentage_failure', 2)
| where successful_login>0 AND login_error>7
| table username, ipAddress, redirect_uri, successful_login, login_error, percentage_failure

[gcusello · Accepted solution]

Hi9 @jhilton90,

because, after a stats command, you have only the fields in the stats and redirect_uri isn't one of them, you should add it to the stats command using e.g. vales as option:

index=keycloak customerReferenceAccountId!=SERVICE* username!=test*@test.co.uk type=LOGIN*
| stats 
   values(redirect_uri) AS redirect_uri 
   count(eval(type="LOGIN")) AS successful_login 
   count(eval(type="LOGIN_ERROR")) AS login_error 
   BY username ipAddress
| eval percentage_failure=((successful_login/login_error)*100)
| eval percentage_failure=round('percentage_failure', 2)
| where successful_login>0 AND login_error>7
| table username, ipAddress, redirect_uri, successful_login, login_error, percentage_failure

 Ciao.

Giuseppe

[jhilton90]

Ohhhhhh of course!! Thank you 🙂

[gcusello]

Hi @jhilton90,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉