I want to design a design a a dashboard that will allow us to add a server to daily checks for logins from multiple ip users, multiple failed IP addresses and foreign IP addresses. Please, I will appreciate a well explained answer as i am still new to this .
Thanks
You could run a search against the index where the server sits and filter through the IPs by using the | 'dedup' 'distinctcount'/dc command. i.e index=x sourcetype=myserver | chart dc(local_Ipaddresses)
You can simply replace (local_Ipaddresses) with the variable name of your foreign Ip address.
If you want to check failed logins... you can do something like: index=x sourcetype=myserver failed | chart dc(local_Ipaddresses)
the search above will give you all the unique IP addresses with failed login attemps. if you want to count how many login attempts they've made: index=x sourcetype=myserver failed | stats count by local_Ipaddresses
I hope this helps mate.
To clarify: You want to build one dashboard for one specific server?
@amarachijoy
I see you voted on my comment. Is that a yes to my question?
Also, could you tell us a little more about your data? Which fields (like src_ip,dest_port...) are available when searching for your data?