adding a collum in a "...| chart count by x"

[Aufex]

Hello,
my querry
'sourcetype="xxx" radius authentication failed | chart count by user | sort - count'
gives me a nice little chart und a table under it. My problem is that i can not add an additional collum "NAS_IP_Adress".

can you give me any tips? thanks

[somesoni2 · Accepted solution]

You can update your table like you described using following search:

sourcetype="xxx" radius authentication failed | stats count by user NAS_IP | sort - count

[Aufex]

perfect, thank you!!

[somesoni2]

Glad this fulfilled your requirement. Don't forget to close the question by accepting this answer.

[somesoni2]

It'll depend upon what your final output is going to look like. Can you post some mock table output or describe how your chart should look like with your NAS_IP_ADDRESS field?

[Aufex]

the chart only show you the users and the number of events of each user.
the table should show you user,NAS_IP, count(user)

there can only be one NAS_IP for each user