I am working on eval expression. I have a set of data and I want to evaluate a field such that I only extract login authentication messages.
The following search string helps to extract only logins:
| eval logins=if(like(message,"Login%"),"is_login","is_not_login")
is_login :84 events (failed and successful login events)
is_not_login: 551 events (all other events)
I would like to create a second eval expression where I zoom in on "is_login" field and further split the values into two.
|eval action=if(like(is_login,"Login failed%"),"Failure","Success")
No Failure value in 'action' field.
Success: 635 events (whole log file events)
I expect to get a field 'action' with two values within it, Failure and Success. However I only get one Success value which represents all events from the log file itself.
Combined eval search:
| eval logins=if(like(message,"Login%"),"is_login","is_not_login") |eval action=if(like(is_login,"Login failed%"),"Failure","Success")
I need help to see if my logic is correct, the first eval seperates login events from all other events, the second eval further divides the failed and successful login events.
The first eval
loses the the original text in 'message'. Later eval
s need to refer to 'message' as well. Try this:
| eval logins=if(like(message,"Login%"),"is_login","is_not_login") | eval action=case(like(message,"Login failed%") AND logins=="is_login", "Failure", NOT like(message,"Login failed%") AND logins=="is_login", "Success", 1=1, "")
Logins has two values is_login and is_not_login. So in second event you cant perform eval on values, "like" function work on fields not on values.