Hello,
my querry
'sourcetype="xxx" radius authentication failed | chart count by user | sort - count'
gives me a nice little chart und a table under it. My problem is that i can not add an additional collum "NAS_IP_Adress".
can you give me any tips? thanks
You can update your table like you described using following search:
sourcetype="xxx" radius authentication failed | stats count by user NAS_IP | sort - count
You can update your table like you described using following search:
sourcetype="xxx" radius authentication failed | stats count by user NAS_IP | sort - count
perfect, thank you!!
Glad this fulfilled your requirement. Don't forget to close the question by accepting this answer.
It'll depend upon what your final output is going to look like. Can you post some mock table output or describe how your chart should look like with your NAS_IP_ADDRESS field?
the chart only show you the users and the number of events of each user.
the table should show you user,NAS_IP, count(user)
there can only be one NAS_IP for each user