Is it possible to have eventtypes for user authentication with different events?

[pjohnson1]

Is it possible to have eventtypes for user authentication with different events?

I am working on a TA for Aruba user authentication logs.

I have the action=success completed event 522008 but action=failure will be from another event 522042 (not the same event ID).

SAMPLE EVENTS

Successful

 Oct 19 04:19:24 awc1 authmgr[1883]: <522008> <NOTI> <awc1 192.168.1.10>  User Authentication Successful: username=john.doe MAC=08:15:96:ab:ac:e0 IP=192.168.2.10 role=authenticated VLAN=601 AP=102.168.2.1 SSID=corp AAA profile=Auth_AaaProfile auth method=802.1x auth server=radius.lab.com

Failed

Oct 19 23:57:03 awc1 authmgr[1883]: <522042> <NOTI> <awc1 192.168.1.10>  User Authentication Failed: username=john.doe MAC=08:15:96:ab:ac:e0 IP=0.0.0.0 auth method=802.1x auth server=radius.lab.com

CONFIGS

eventtypes.conf

[aruba_user_authentication]
search = sourcetype=aruba_syslog Error_ID=522008
#tags = authentication default

transforms.conf

[aruba_user_action]
REGEX = Authentication\s+(Successful|failed)
FORMAT = aruba_user_action::$1

Thanks.

[pjohnson1 · Accepted solution]

UPDATE

By amending the search in eventtypes.conf I managed to get the failure's too..

eventtypes.conf

 [aruba_user_authentication]
 search = sourcetype=aruba_syslog Error_ID=522008 OR OR Error_ID=522042
 #tags = authentication default

[MuS]

Took me too long to type - so deleting my answer as you got it right here 🙂